---
title: "Update a member's role or permission overrides"
method: PATCH
path: "/api/members/{id}"
tags: ["Team members"]
---

# Update a member's role or permission overrides

`PATCH /api/members/{id}`

## Request

- Base URL: `https://api.setluca.com`
- URL: `https://api.setluca.com/api/members/{id}`
- Auth: API key in cookie `luca.session_token`

**Session-only.** This endpoint isn't on the API-key allowlist. An organization API key gets a 403 here, whatever scopes it holds.

## Path parameters

- `id` string, required

## Headers

- `Luca-API-Version` '1'

## Request body

- UpdateMemberBody
  - `role` 'admin' | 'manager' | 'operator' | 'analyst' | 'viewer'
  - `permissionOverrides` object
    - `allow` string[]

## Response `200`

ok

- UpdateMemberResponse
  - `member` object, required
    - `id` string, required
    - `userId` string, required
    - `email` string, required
    - `name` string, required
    - `role` 'owner' | 'admin' | 'manager' | 'operator' | 'analyst' | 'viewer', required
    - `permissionOverrides` object, nullable, required
      - `allow` string[]
    - `joinedAt` string, required
    - `capabilities` object, required
      - `updateRole` boolean, required
      - `remove` boolean, required

## Other responses

- `400`: bad request
- `401`: unauthorized
- `403`: forbidden
- `404`: not found
- `409`: conflict
- `410`: gone
- `429`: rate limited
- `500`: internal error
- `503`: service unavailable

---

[API](https://skmtc.dev/setluca/apis/luca-api.md) · [All operations](https://skmtc.dev/setluca/apis/luca-api/llms.txt) · [OpenAPI document](https://skmtc.dev/setluca/apis/luca-api/revisions/90a200e4100b?raw)