---
title: "Update User Permissions"
method: PATCH
path: "/v1/account-users/{user_id}"
tags: ["Users", "v1"]
---

# Update User Permissions

`PATCH /v1/account-users/{user_id}`

Replaces the permissions for an existing user on the account. The submitted `permissions` array is applied in full — any permission identifier absent from the array is revoked. To remove all access, submit an empty array — this fully revokes the user's access on the account without deleting the user record.

:::info
Requires the `users:write` OAuth2 scope.
:::

## Path parameters

- `user_id` string, required

## Query parameters

- `account_id` string, required

## Request body

- object
  - `data` object, required
    - `type` 'account_user', required
    - `attributes` object, required
      - `permissions` string[], required — The user's granted permissions as a flat list of identifiers in `{product}.{key}` format. Any identifier absent from the array is treated as not granted. Use `GET /v1/user-permissions` to retrieve all available identifiers.

## Response `200`

Account user details

- object
  - `data` AccountUserV1, required
    - `type` 'account_user', required — The type of the object.
    - `id` string, required — The user ID.
    - `attributes` object, required
      - `email` string, email, required — The user's email address.
      - `first_name` string, nullable, required — The user's first name.
      - `last_name` string, nullable, required — The user's last name.
      - `invitation_accepted` boolean, required — Whether the user has accepted their invitation to the account. `false` indicates a pending invitation.
      - `permissions` string[], required — The user's granted permissions as a flat list of identifiers in `{product}.{key}` format. Any identifier absent from the array is treated as not granted. Use `GET /v1/user-permissions` to retrieve all available identifiers.
  - `meta` object, required
    - `request_id` string, required — A unique identifier assigned to each API request for end-to-end traceability.

## Other responses

- `400` — Bad Request
- `401` — Unauthorized. The request was rejected because the credentials are missing, invalid, expired, or have been revoked. The client must re-authenticate before retrying. Clients can differentiate via the `code` value of the first item in `errors`.
- `403` — Forbidden. The credentials are valid but the caller is not authorized to perform the request — typically because the user lacks the required permission, the OAuth scope is insufficient, the subscription plan does not include the required entitlement, the `account_id` does not belong to the authenticated user, or the target list is read-only and its members cannot be modified. Clients can differentiate via the `code` value of the first item in `errors`.
- `404` — Not found
- `422` — Unprocessable entity
- `429` — Too many requests. Either the per-second rate limit or the monthly quota configured for the API key / OAuth application has been exceeded. Clients can differentiate via the `code` value of the first item in `errors`.
- `500` — Internal server error
- `504` — Server timeout

## Changes

> 17 revisions in range; 1 not diffed.

- **2026-09-01** `885dcce2a6c2` — 1 info
  - endpoint added

[Change history](https://skmtc.dev/leadfeeder/apis/leadfeeder-public-api/changes/v1/account-users/:user_id/patch.md)

---

[API](https://skmtc.dev/leadfeeder/apis/leadfeeder-public-api.md) · [All operations](https://skmtc.dev/leadfeeder/apis/leadfeeder-public-api/llms.txt) · [OpenAPI document](https://skmtc-service-production.skmtc.workers.dev/v1/apis/leadfeeder/leadfeeder-public-api/revisions/885dcce2a6c2/schema)