---
title: "Apply User Role Change"
method: POST
path: "/internal/migration/users/{user_id}/apply"
tags: ["internal"]
---

# Apply User Role Change

`POST /internal/migration/users/{user_id}/apply`

Move a user's role attachments: add company roles, remove (typically global) roles.

DB-only by design — company-scoped archetype roles are never mirrored to SuperTokens
(authz reads the DB; only the global ``kobalt_admin`` claim is mirrored, and this flow
never touches it). Invalidates the user's permission + vendor-access caches so the change
takes effect at once across replicas.

## Path parameters

- `user_id` string, uuid, required

## Request body

- UserRoleChangeRequest
  - `add_role_ids` string[]
  - `remove_role_ids` string[]

## Response `200`

Successful Response

- ApplyUserRoleChangeResponse
  - `user_id` string, required
  - `roles` MigrationUserRole[], required
    - `role_id` string, required
    - `role_name` string, required
    - `scope` string, required
    - `archetype` 'tprm_admin' | 'business_owner' | 'tprm_analyst' | 'sme' | 'view_only' | 'collateral_admin' | 'collateral_reviewer' | 'collateral_submitter' | 'policy_reviewer' — Closed, product-owned set of role identities. Stable machine keys — never renamed.
    - `module` string, nullable
  - `added` string[], required
  - `removed` string[], required

## Other responses

- `422` — Validation Error

---

[API](https://skmtc.dev/kobaltlabs/apis/fastapi.md) · [All operations](https://skmtc.dev/kobaltlabs/apis/fastapi/llms.txt) · [OpenAPI document](https://skmtc-service-production.skmtc.workers.dev/v1/apis/kobaltlabs/fastapi/revisions/3ff4c0bd276b/schema)