---
title: "Update Role"
method: PUT
path: "/roles/{role_id}"
tags: ["Roles"]
---

# Update Role

`PUT /roles/{role_id}`

## Request

- Base URL: `https://be.graph8.com/api/v1`
- URL: `https://be.graph8.com/api/v1/roles/{role_id}`
- Auth: HTTP bearer

Redefine a role. THIS CHANGES WHAT EVERY HOLDER MAY DO, IMMEDIATELY.

`permissions` REPLACES the list rather than merging into it, so a value
left out is a permission taken away from everyone who holds the role. That
is why this operation is tiered `destructive` rather than `write`: it is a
privilege change, and "re-define what the sales team may do" must not ride
along in the same grant as "rename a team".

The app refuses to edit the permissions of its locked system roles
(`admin`, `service_provider`) - stripping `roles:manage` from `admin`
would lock the organisation out with no recovery path - and refuses to
grant anything the caller does not hold. Both reach you as a 403.

## Path parameters

- `role_id` string, required: Role id (UUID).

## Headers

- `Authorization` string, nullable
- `X-Target-Org-Id` string, nullable

## Request body

- RoleUpdateRequest: Replace a role's definition. Mirrors `roles.RoleUpdateRequest`. `permissions` is a REPLACEMENT, not a merge, and it takes effect for everyone who already holds the role. That is why the operation is tiered `destructive` rather than `write`.
  - `name` string, nullable
  - `description` string, nullable
  - `permissions` string[], nullable
  - `manages_role_slugs` string[], nullable
  - `rep_limits` RepLimitsSettings: Per-role reveal/ownership limits. Mirrors `roles.RepLimitsSettings`. The three `Literal`s are closed here rather than left as strings because they reach the app's own `Literal` inside `_apply_rep_limits`.
    - `max_contacts` integer, nullable
    - `max_companies` integer, nullable
    - `conflict_company_owned` 'allow' | 'warn' | 'block'
    - `conflict_contact_active` 'allow' | 'warn' | 'block'
    - `reveal_policy` 'within_limits' | 'monthly_credit_budget' | 'no_limit'
    - `reveal_monthly_credit_budget` integer, nullable

## Response `200`

Successful Response

- ApiResponseOrgPayload
  - `data` OrgPayload, required: An open envelope for a single role, team, member or account record. Open on purpose. The app's own response models on this surface grow with the product - `RoleResponse` gained `rep_limits` and `manages_role_slugs`, `TeamResponse` gained channel counts and a campaign count - and a pinned mirror would SILENTLY DROP whatever it had not caught up on. A dropped permission in a role read is the worst possible kind of stale: it reads as "they do not have it".
  - `pagination` PaginationMeta
    - `page` integer, required: Current page number (1-indexed)
    - `limit` integer, required: Items per page
    - `total` integer, required: Total number of items
    - `has_next` boolean, required: Whether there are more pages
    - `next_cursor` string, nullable: Opaque cursor for the next page; null when there are no more items. Pass it back as the `cursor` query param to fetch the following page without computing page numbers.
    - `total_available` integer, nullable: Search endpoints only: how many records really match, when known. Can be larger than `total`, which is capped at the 10,000 results that can be paged. For company search this is a distinct-company estimate. Null when unknown; absent outside search.
    - `total_is_lower_bound` boolean, nullable: Search endpoints only: true when more records match than `total` shows (the result set is larger than the 10,000 results that can be paged). Absent outside search.
    - `notes` string[], nullable: Search endpoints only: plain-language notes about the result, e.g. that more records match than can be paged, or that a reversed `between` range was put in order.

## Other responses

- `422`: Validation Error

---

[API](https://skmtc.dev/graph8/apis/graph8-developer-api.md) · [All operations](https://skmtc.dev/graph8/apis/graph8-developer-api/llms.txt) · [OpenAPI document](https://skmtc.dev/graph8/apis/graph8-developer-api/revisions/2e7cfa0ca921?raw)