MOmongodb
Database Users

Update One Database User in One Project

Updates one database user that belongs to the specified project.

patch/api/atlas/v2/groups/{groupId}/databaseUsers/{databaseName}/{username}

Request

  • Base URL
    https://cloud.mongodb.com
  • URL
    https://cloud.mongodb.com/api/atlas/v2/groups/{groupId}/databaseUsers/{databaseName}/{username}
  • Auth
    • OAuth 2
      Client credentials
      Token URL: https://cloud.mongodb.com/api/oauth/token
    • or HTTP digest

Path parameters

groupIdstring required
Example:32b6e34b3d91647abb20e7b8

Unique 24-hexadecimal digit string that identifies your project. Use the /groups endpoint to retrieve all projects to which the authenticated user has access.

NOTE: Groups and projects are synonymous terms. Your group id is the same as your project id. For existing groups, your group/project id remains the same. The resource and corresponding endpoints use the term groups.

databaseNamestring required

The database against which the database user authenticates. Database users must provide both a username and authentication database to log into MongoDB. If the user authenticates with AWS IAM, x.509, LDAP, or OIDC Workload this value should be $external. If the user authenticates with SCRAM-SHA or OIDC Workforce, this value should be admin.

usernamestring required
Example:SCRAM-SHA: dylan or AWS IAM: arn:aws:iam::123456789012:user/sales/enterprise/DylanBloggs or x.509/LDAP: CN=Dylan Bloggs,OU=Enterprise,OU=Sales,DC=Example,DC=COM or OIDC: IdPIdentifier/IdPGroupName

Human-readable label that represents the user that authenticates to MongoDB. The format of this label depends on the method of authentication:

Authentication MethodParameter NeededParameter Valueusername Format
AWS IAMawsIAMTypeROLE<abbr title="Amazon Resource Name">ARN</abbr>
AWS IAMawsIAMTypeUSER<abbr title="Amazon Resource Name">ARN</abbr>
x.509x509TypeCUSTOMERRFC 2253 Distinguished Name
x.509x509TypeMANAGEDRFC 2253 Distinguished Name
LDAPldapAuthTypeUSERRFC 2253 Distinguished Name
LDAPldapAuthTypeGROUPRFC 2253 Distinguished Name
OIDC WorkforceoidcAuthTypeIDP_GROUPAtlas OIDC IdP ID (found in federation settings), followed by a '/', followed by the IdP group name
OIDC WorkloadoidcAuthTypeUSERAtlas OIDC IdP ID (found in federation settings), followed by a '/', followed by the IdP user name
SCRAM-SHAawsIAMType, x509Type, ldapAuthType, oidcAuthTypeNONEAlphanumeric string

Query parameters

envelopeboolean

Flag that indicates whether Application wraps the response in an envelope JSON object. Some API clients cannot access the HTTP response headers or status code. To remediate this, set envelope=true in the query. Endpoints that return a list of results use the results object as an envelope. Application adds the status parameter to the response body.

prettyboolean

Flag that indicates whether the response body should be in the prettyprint format.

Request body

awsIAMType'NONE' | 'USER' | 'ROLE'

Human-readable label that indicates whether the new database user authenticates with the Amazon Web Services (AWS) Identity and Access Management (IAM) credentials associated with the user or the user's role.

databaseName'admin' | '$external' required

The database against which the database user authenticates. Database users must provide both a username and authentication database to log into MongoDB. If the user authenticates with AWS IAM, x.509, LDAP, or OIDC Workload this value should be $external. If the user authenticates with SCRAM-SHA or OIDC Workforce, this value should be admin.

deleteAfterDatestring date-time

Date and time when MongoDB Cloud deletes the user. This parameter expresses its value in the ISO 8601 timestamp format in UTC and can include the time zone designation. You must specify a future date that falls within one week of making the Application Programming Interface (API) request.

descriptionstring

Description of this database user.

groupIdstring required

Unique 24-hexadecimal digit string that identifies the project.

ldapAuthType'NONE' | 'GROUP' | 'USER'

Part of the Lightweight Directory Access Protocol (LDAP) record that the database uses to authenticate this database user on the LDAP host.

oidcAuthType'NONE' | 'IDP_GROUP' | 'USER'

Human-readable label that indicates whether the new database user or group authenticates with OIDC federated authentication. To create a federated authentication user, specify the value of USER in this field. To create a federated authentication group, specify the value of IDP_GROUP in this field.

passwordstring

Alphanumeric string that authenticates this database user against the database specified in databaseName. To authenticate with SCRAM-SHA, you must specify this parameter. This parameter doesn't appear in this response.

usernamestring required

Human-readable label that represents the user that authenticates to MongoDB. The format of this label depends on the method of authentication:

Authentication MethodParameter NeededParameter Valueusername Format
AWS IAMawsIAMTypeROLE<abbr title="Amazon Resource Name">ARN</abbr>
AWS IAMawsIAMTypeUSER<abbr title="Amazon Resource Name">ARN</abbr>
x.509x509TypeCUSTOMERRFC 2253 Distinguished Name
x.509x509TypeMANAGEDRFC 2253 Distinguished Name
LDAPldapAuthTypeUSERRFC 2253 Distinguished Name
LDAPldapAuthTypeGROUPRFC 2253 Distinguished Name
OIDC WorkforceoidcAuthTypeIDP_GROUPAtlas OIDC IdP ID (found in federation settings), followed by a '/', followed by the IdP group name
OIDC WorkloadoidcAuthTypeUSERAtlas OIDC IdP ID (found in federation settings), followed by a '/', followed by the IdP user name
SCRAM-SHAawsIAMType, x509Type, ldapAuthType, oidcAuthTypeNONEAlphanumeric string
x509Type'NONE' | 'CUSTOMER' | 'MANAGED'

X.509 method that MongoDB Cloud uses to authenticate the database user.

  • For application-managed X.509, specify MANAGED.
  • For self-managed X.509, specify CUSTOMER.

Users created with the CUSTOMER method require a Common Name (CN) in the username parameter. You must create externally authenticated users on the $external database.

Example request

{
  "links": [
    {
      "href": "https://cloud.mongodb.com/api/atlas",
      "rel": "self"
    }
  ]
}

Response

OK

Changes

No recorded changes to this operation across all 1 revision of this API.