---
title: "Change a team member's role"
method: PATCH
path: "/v1/teams/{team}/members/{member}/role"
tags: ["Team Members"]
---

# Change a team member's role

`PATCH /v1/teams/{team}/members/{member}/role`

## Request

- Base URL: `https://api.subscriby.net`
- URL: `https://api.subscriby.net/v1/teams/{team}/members/{member}/role`
- Auth: HTTP bearer

```bash
curl -X PATCH https://api.subscriby.net/v1/teams/$TEAM_ID/members/$USER_ID/role \
  -H "Authorization: Bearer $SUBSCRIBY_TOKEN" \
  -H "Idempotency-Key: $(uuidgen)" \
  -H "Content-Type: application/json" \
  -d '{"role": "manager"}'
```

Moves a collaborator onto another of the team's roles. The team **owner** cannot be re-roled: ownership is not a membership row and carries everything unconditionally. Answers `200` with the membership and emits `team.member.role_changed`.

Changing a member's role has **no dashboard equivalent**: the settings page offers invite, remove and cancel-invitation only, so this endpoint is the only way to move someone between roles without removing and re-inviting them.

## Path parameters

- `team` string, uuid, required
- `member` string, required

## Headers

- `Idempotency-Key` string, uuid, required

## Request body

- UpdateTeamMemberRoleRequest: The role to move a collaborator onto.
  - `role` string, required: A role **code** on the team, such as `manager`, not a role id. An unknown code is refused.

## Response `200`

The membership after the change.

- object
  - `data` TeamMemberResource, required: One person's place on a team: their profile plus their role on the queried team. The owner's pseudo-row carries `is_owner: true` and a null role.
    - `id` string, required: The collaborator's user id, the value the member routes take.
    - `team_id` string, required: The team the membership is on.
    - `name` string, required: The collaborator's name.
    - `email` string: The collaborator's email address. Present only for a token holding `team-member:view`; a roster-only token gets no `email` key at all, not null. The show route requires that ability, so it always includes it.
    - `role_id` string, nullable, required: The role the collaborator holds on this team, or null for the owner pseudo-row.
    - `is_owner` boolean, required: True only for the single team creator, who is returned alongside the members but bypasses the membership table entirely.
    - `joined_at` string, nullable, required: When the collaborator joined, ISO 8601; the team's creation for the owner.

## Other responses

- `400`: `IDEMPOTENCY_KEY_MISSING`: every write needs an `Idempotency-Key` header. Send a fresh UUID per distinct operation.
- `401`: `AUTHENTICATION_REQUIRED`: the request carries no bearer token, or one that is revoked, malformed, or minted for another environment (an `sbt_test_` token on production).
- `403`: `TOKEN_MISSING_ABILITY`: the token is valid but does not carry the ability this endpoint requires; `error.context.required_ability` names the one to grant. An endpoint that also checks who owns a row or which tier the account is on answers `FORBIDDEN`, `TEAM_TIER_REQUIRED` or `CONNECTOR_TIER_REQUIRED` with the same status, and says so in its own description. On this endpoint: `TEAM_TIER_REQUIRED`: below the Growth tier; nothing changes.
- `404`: `RESOURCE_NOT_FOUND`: an id in the path names nothing the token can see. `TENANT_MISMATCH`: the project sits outside the token's `scope:project:` allow-list, or the token carries no team scope. Both answer 404 rather than 403 so that existence outside the token's scope cannot be inferred. On this endpoint: `RESOURCE_NOT_FOUND`: for the owner, who has no role to change, or for someone who is not in the team.
- `409`: `IDEMPOTENCY_KEY_REUSED`: the key was already used in the last 24 hours with a different request body.
- `422`: `VALIDATION_FAILED`: the payload broke a rule, and `error.fields` maps each offending key to its messages. A refusal from the domain, such as a plan that cannot go on sale or a member who cannot be removed, uses the same code with `error.message` saying why and no `fields`. On this endpoint: `VALIDATION_FAILED`: when the role code is not one of the team's.
- `425`: `IDEMPOTENCY_REPLAY_IN_PROGRESS`: the first request with this key is still running; retry in a few seconds and the original response is replayed.
- `429`: `RATE_LIMITED`: the token has spent its 300 requests a minute or 10,000 an hour; `Retry-After` says when the next one is accepted.

---

[API](https://skmtc.dev/memberpass/apis/subscriby-rest-api.md) · [All operations](https://skmtc.dev/memberpass/apis/subscriby-rest-api/llms.txt) · [OpenAPI document](https://skmtc.dev/memberpass/apis/subscriby-rest-api/revisions/59c4df91d764?raw)