---
title: "Update User"
method: PUT
path: "/admin/user"
tags: ["Admin"]
---

# Update User

`PUT /admin/user`

## Request

- Base URL: `https://api.speakai.co/v1`
- URL: `https://api.speakai.co/v1/admin/user`
- Auth: API key in header `x-speakai-key` and API key in header `x-access-token`

## Update User Details

This endpoint allows administrators to update the details of a user in the system. It is a PUT request that modifies the user's information based on the provided payload.

### Request Parameters

The request body should be a JSON object with the following parameters:

- **_id** (string): The unique identifier of the user to be updated.

- **email** (string): The email address of the user. This field can be left empty if no change is required.

- **firstName** (string): The first name of the user.

- **lastName** (string): The last name of the user.

- **isActive** (boolean): Indicates whether the user account is active.

- **isVerified** (boolean): Indicates whether the user's email has been verified.

- **permission** (object): An object that defines the permissions for the user with the following keys:

 - **audio** (boolean): Permission to access audio features.

 - **video** (boolean): Permission to access video features.

 - **text** (boolean): Permission to access text features.

 - **addPayment** (boolean): Permission to add payment methods.

 - **userManagement** (boolean): Permission to manage other users.


### Expected Response

Upon a successful update, the API will return a response indicating the status of the operation. The response typically includes a success message and may also return the updated user details.

### Notes

- Ensure that the user ID provided in the request is valid and corresponds to an existing user in the system.

- The permissions object allows for fine-grained control over what the user can access, so be sure to set these values according to your application's requirements.

- If any required fields are missing or invalid, the API will return an error response with details about the issue.

## Request body

- object
  - `_id` string: Give the id of the user you are updating. The validator treats it as optional, but the update fails without it. Optional in the schema, and unlike the create schema it does not allow an empty string. The controller calls User.findById(_id) and returns 404 when nothing matches, so omitting it returns 404 rather than 400.
  - `email` string, required: Give the user's email address. You have to send a valid one on every update, even though the update ignores it. Required. Must be a valid email address. Lowercased and trimmed. An empty string is rejected. The controller never reads this key, so you cannot use it to change the address.
  - `firstName` string: Set the user's first name. Leave it out to keep the stored value. Optional. Trimmed. No minimum or maximum length. Omitted keys are stripped from the update, so they keep their stored values (keys you leave out are not written).
  - `lastName` string: Set the user's last name. Leave it out to keep the stored value. Optional. Trimmed. No minimum or maximum length. Omitted keys are stripped from the update, so they keep their stored values.
  - `isActive` boolean: Set whether the account stays active. Send false to deactivate the user, which also disconnects their calendars. Optional. The declared default is true, but the middleware discards the converted value, so no default is applied to the request and leaving it out keeps the current state. Sending false for a currently active user triggers a calendar disconnect.
  - `isVerified` boolean: Accepted for compatibility. The update endpoint ignores it. Optional. The declared default is true, with the same discarded-conversion caveat. The update controller never reads this key.
  - `permission` object: Set what the user can do. The validator treats this as optional, but the update fails without it. Same fixed key set as the create endpoint, defined. Unknown keys are rejected. Accepted keys: `role` (string, one of owner, admin, member); `folder` object with create, delete, download, share, assign, accessAll; `recorder` object with create, edit, delete, download, accessAll; `media` object with delete, edit, download, share; `payment` object with manageCards, manageInvoices; `teamManagement` object with manageMembers, manageGroups; `developer` object with accessKeys; `profileSettings` object with accountPreferences, accountCustomization, dataManagement; `meetingAssistant` object with customizeAssistant, shareMeetings, routeMeetings, excludeMeetings, globalSettings. Every leaf key is a boolean. The controller reads permission.role without a null check, and the resulting error is caught at:237-240, so omitting permission returns 500 rather than 400. Setting meetingAssistant.customizeAssistant to false also deletes the user's meeting assistant settings (:214-224).

## Response `200`

Success

---

[API](https://skmtc.dev/speakai/apis/speak-ai-api.md) · [All operations](https://skmtc.dev/speakai/apis/speak-ai-api/llms.txt) · [OpenAPI document](https://skmtc.dev/speakai/apis/speak-ai-api/revisions/52d777e6d46e?raw)