---
title: "Update a user."
method: PUT
path: "/users/{userId}.json"
tags: ["Users"]
---

# Update a user.

`PUT /users/{userId}.json`

## Request

- Base URL: `https://passbolt.local`
- URL: `https://passbolt.local/users/{userId}.json`
- Auth: HTTP bearer
- TypeScript: <https://skmtc.dev/passbolt/apis/passbolt-api/docs/users/:userId.json/put.ts> (a function with typed inputs; its response is checked against the schema)

Neither the email or the username field which can be updated, and only administrators can update a user's role.

## Path parameters

- `userId` string, uuid, required

## Request body

- UserUpdate
  - `role_id` string, uuid
  - `disabled` boolean
  - `profile` object
    - `first_name` string
    - `last_name` string
    - `avatar` object
      - `file` string, required: Image file in binary format.

## Response `200`

Operation is successful

- object
  - `header` Header, required
    - `id` string, uuid, required
    - `status` 'success' | 'error', required
    - `servertime` integer, required
    - `action` string, uuid, required
    - `message` string, required
    - `url` string, uri, required
    - `code` integer, required
  - `body` UserIndexAndView[], required
    - `is_mfa_enabled` boolean
    - `id` string, uuid, required
    - `role_id` string, uuid, required
    - `username` string, required
    - `active` boolean, required
    - `deleted` boolean, required
    - `created` string, date-time, required
    - `modified` string, date-time, required
    - `disabled` string, date-time, required
    - `profile` object
      - `id` string, uuid, required
      - `user_id` string, uuid, required
      - `first_name` string, required
      - `last_name` string, required
      - `created` string, date-time, required
      - `modified` string, date-time, required
      - `avatar` object, required
        - `id` string, uuid
        - `profile_id` string, uuid
        - `created` string, date-time
        - `modified` string, date-time
        - `url` object, required
          - `medium` string, url, required
          - `small` string, url, required
    - `groups_users` GroupsUsersIndexAndView
      - `id` string, uuid, required
      - `group_id` string, uuid, required
      - `user_id` string, uuid, required
      - `is_admin` boolean, required
      - `created` string, date-time, required
      - `user` UserIndexAndView (recursive)
    - `gpgkey` Gpgkey
      - `id` string, uuid, required
      - `user_id` string, uuid, required
      - `armored_key` string, required
      - `bits` integer, required
      - `uid` string, required
      - `key_id` string, required
      - `fingerprint` string, required
      - `type` 'RSA' | 'ECC', required
      - `expires` string, date-time, required
      - `deleted` boolean, required
      - `created` string, date-time, required
      - `modified` string, date-time, required
    - `role` Role
      - `id` string, uuid, required
      - `name` 'admin' | 'guest' | 'user', required
      - `description` string, required
      - `created` string, date-time, required
      - `modified` string, date-time, required
    - `missing_metadata_key_ids` string[]
    - `last_logged_in` string, date-time

## Other responses

- `400`: Bad request
- `401`: Authentication required.
- `404`: Not found

## Changes

- **2025-06-25** `829cf48ab700`: 1 info
  - added the optional property `body/items/missing_metadata_key_ids` to the response with the `200` status

[Operation history](https://skmtc.dev/passbolt/apis/passbolt-api/changes/users/:userId.json/put.md)

---

[API](https://skmtc.dev/passbolt/apis/passbolt-api.md) - [All operations](https://skmtc.dev/passbolt/apis/passbolt-api/llms.txt) - [OpenAPI document](https://skmtc.dev/passbolt/apis/passbolt-api/revisions/8d72215e2274?raw)