---
title: "Change a member's role"
method: PATCH
path: "/v1/projects/{project_id}/members/{member_id}"
tags: ["Projects"]
---

# Change a member's role

`PATCH /v1/projects/{project_id}/members/{member_id}`

## Request

- Base URL: `https://api.naturali.ai`
- URL: `https://api.naturali.ai/v1/projects/{project_id}/members/{member_id}`
- Auth: one of:
  - HTTP bearer
  - OAuth 2 (authorization code, authorization URL `https://api.naturali.ai/authorize`, token URL `https://api.naturali.ai/token`, scopes: `mcp:access`)

Moves a member between `admin` and `member`. The project `owner` only: promoting somebody to `admin` hands them every write in the project, and an `admin` who could do that could erase the difference between the two roles for themselves.

The owner's own row is refused in either direction — it names who pays, so changing it is a transfer (`PUT /v1/projects/{project_id}/transfer`) rather than a role change.

## Request body

- ProjectMemberUpdate
  - `role` 'admin' | 'member', required: The roles a membership write may name. `owner` is absent by construction: it is the billing owner, so granting it would change who pays, and transferring that is a different act with its own decision.

## Response `200`

The member's new role.

- ProjectMember
  - `id` string, required: Public membership ID (pmem_ prefix).
  - `project_id` string, required
  - `user_id` string, required
  - `email` string, email, nullable, required: The member's address; null if the account no longer exists.
  - `name` string, nullable, required
  - `status` 'active' | 'pending', nullable, required: `pending` until the member has signed in for the first time, `active` afterwards. Derived from the account, not stored, so it needs nothing to run when they arrive. Null if the account no longer exists — there is no status to report for somebody who is never arriving.
  - `role` 'owner' | 'admin' | 'member', required: What the member may do in this project. `owner` — everything, including deleting it and paying for it; exactly one per project. `admin` — everything a `member` may do, plus managing who else is in the project and how the project itself is configured. `member` — every read and write on the project's own resources, including minting project API keys. When returned on a `Project`, this is *your* role, not a property of the project: it is what lets a client hide an action the request would refuse.
  - `invited_by_user_id` string, nullable, required: Who added this member; null for the founding owner, who was added by the act of creating the project.
  - `created_at` string, date-time, required

## Other responses

- `400`: A `role` outside `admin`/`member`, or the owner's own row.
- `401`: Missing or invalid credentials.
- `403`: The credential is scoped to a different project, or the caller's role in the project does not carry this action.
- `404`: The resource does not exist (existence is not leaked).

---

[API](https://skmtc.dev/naturali/apis/naturali-ai-api.md) · [All operations](https://skmtc.dev/naturali/apis/naturali-ai-api/llms.txt) · [OpenAPI document](https://skmtc.dev/naturali/apis/naturali-ai-api/revisions/e4905b78f422?raw)