---
title: "Change a member's permission or answer your own invite"
method: PUT
path: "/organization-roles/{id}"
tags: ["Organization Roles"]
---

# Change a member's permission or answer your own invite

`PUT /organization-roles/{id}`

## Request

- Base URL: `https://api.purplegrain.com/api/v1`
- URL: `https://api.purplegrain.com/api/v1/organization-roles/{id}`
- Auth: HTTP bearer

Change a member's permission, or let an invitee accept or decline their
own invite. The role's own user may set `status` alone to `accepted` or
`declined`. Anything else, including `permission`, needs edit rights on
the business. A new permission cannot be more privileged than the
caller's own role; an owner may assign any.

## Path parameters

- `id` string, required

## Query parameters

- `include` string

## Request body

- OrganizationRoleUpdateModelAttributes: Flat attributes-adapter request body (Content-Type application/json). Attribute fields and relationships live directly under `data` (no nested `attributes` / `relationships` envelopes). Each relationship is a resource identifier object ({ id, type }). Equivalent JSON:API (nested) shape: `OrganizationRoleUpdateModel` sent as application/vnd.api+json.
  - `data` object, required
    - `permission` 'owner' | 'admin' | 'manager' | 'contractor' | 'viewer'
    - `status` 'pending' | 'accepted' | 'declined', nullable
    - `organization` object, nullable, required
      - `id` string, nullable
      - `type` 'organization', nullable
    - `user` object, nullable, required
      - `id` string, nullable
      - `type` 'user', nullable

## Response `200`

Update. When the `include` query parameter is used, the response may contain an `included` array (JSON:API) or inlined related resources (application/json).

- OrganizationRolesShowResponseAttributes
  - `data` OrganizationRoleModelAttributes: Organization role in attributes-adapter shape (Accept application/json); fields at top level.
    - `id` string
    - `type` string
    - `status` 'pending' | 'accepted' | 'declined'
    - `permission` 'owner' | 'admin' | 'manager' | 'contractor' | 'viewer'
    - `invited_email` string, nullable
    - `invited_mobile` string, nullable
    - `invited` boolean
    - `inviter_name` string: Display name of the inviter (the organization owner).
    - `updated_at` string, date-time
    - `created_at` string, date-time
    - `organization` object: Inlined when include=organization
    - `user` object: Inlined when include=user

## Other responses

- `401`: Unauthenticated
- `403`: Forbidden
- `404`: Not Found

---

[API](https://skmtc.dev/purplegrain/apis/purple-grain-api.md) · [All operations](https://skmtc.dev/purplegrain/apis/purple-grain-api/llms.txt) · [OpenAPI document](https://skmtc.dev/purplegrain/apis/purple-grain-api/revisions/4bedbc1c784c?raw)