---
title: "Update group"
method: PATCH
path: "/zones/{zoneId}/groups/{groupId}"
tags: ["Groups"]
---

# Update group

`PATCH /zones/{zoneId}/groups/{groupId}`

## Request

- Base URL: `https://docs.keycard.ai` (the document declares no server; this is the origin it was published from)
- URL: `https://docs.keycard.ai/zones/{zoneId}/groups/{groupId}`
- Auth: one of:
  - HTTP bearer
  - OAuth 2
    - Client credentials
    - Token URL: `/service-account-token`

Updates a group's name and/or identifier (partial update). A group's source is immutable. The name of a group synced from an external directory cannot be changed while external sync is enabled for the zone; its identifier can.

## Path parameters

- `zoneId` string, required
- `groupId` string, required

## Request body

- IamGroupUpdate: Schema for updating a group.
  - `name` string, safe-text: Human-readable group name
  - `identifier` string, safe-text: User-specified identifier, unique within the zone.

## Response `200`

A zone-scoped group of users, assignable to roles and usable in policies. Roles assigned to a group are inherited by its members. `external` is false for groups managed in Keycard and true for groups synced from an external directory.

- IamGroup: A zone-scoped group of users, assignable to roles and usable in policies. Roles assigned to a group are inherited by its members. `external` is false for groups managed in Keycard and true for groups synced from an external directory.
  - `id` string, required: Unique identifier of the group
  - `zone_id` string, required: Zone this group belongs to
  - `organization_id` string, required: Organization this group belongs to
  - `identifier` string, required: User-specified identifier, unique within the zone. Automatically assigned for groups from an external directory.
  - `name` string, required: Human-readable group name
  - `external` boolean, required: Whether the group is synced from an external directory over SCIM. When true the group is directory-owned and its membership is read-only while the zone has `external_sync_enabled` set.
  - `external_issuer` string, nullable, required: Issuer of the external directory the group was synced from. `null` for groups managed in Keycard. Read-only: set by external sync, never by the caller.
  - `member_count` integer: Number of users in the group. Included only when requested via `expand[]=member_count` (group get or list).
  - `roles` string[]: Identifiers of the roles assigned to the group; members inherit them. Deduped across scopes. Included only when requested via `expand[]=roles` (group get or list).
  - `created_at` string, date-time, required: Entity creation timestamp
  - `updated_at` string, date-time, required: Entity update timestamp

## Other responses

- `400`: Error response
- `404`: Error response
- `409`: Error response
- `default`: Error response

## Changes

- **2026-10-16** `0cfaff865771`: 1 info
  - added the required property `external_issuer` to the response with the `200` status
- **2026-08-26** `d65d51379d93`: 1 info
  - endpoint added

[Operation history](https://skmtc.dev/keycardai/apis/keycard-ai-keycard-api/changes/zones/:zoneId/groups/:groupId/patch.md)

---

[API](https://skmtc.dev/keycardai/apis/keycard-ai-keycard-api.md) - [All operations](https://skmtc.dev/keycardai/apis/keycard-ai-keycard-api/llms.txt) - [OpenAPI document](https://skmtc.dev/keycardai/apis/keycard-ai-keycard-api/revisions/0dee67e0a73a?raw)