--- title: "Update" method: PUT path: "/v1/users/{user_id}" tags: ["User"] --- # Update `PUT /v1/users/{user_id}` ## Request - Base URL: `https://api.stytch.com` - URL: `https://api.stytch.com/v1/users/{user_id}` - Auth: HTTP basic Update a User's attributes. **Note:** In order to add a new email address or phone number to an existing User object, pass the new email address or phone number into the respective `/send` endpoint for the authentication method of your choice. If you specify the existing User's `user_id` while calling the `/send` endpoint, the new, unverified email address or phone number will be added to the existing User object. If the user successfully authenticates within 5 minutes of the `/send` request, the new email address or phone number will be marked as verified and remain permanently on the existing Stytch User. Otherwise, it will be removed from the User object, and any subsequent login requests using that phone number will create a new User. We require this process to guard against an account takeover vulnerability. ## Path parameters - `user_id` string, required: The unique ID of a specific User. You may use an `external_id` here if one is set for the user. ## Request body - ApiUserV1UpdateRequest: Request type - `name` ApiUserV1Name - `first_name` string: The first name of the user. - `middle_name` string: The middle name(s) of the user. - `last_name` string: The last name of the user. - `attributes` ApiAttributeV1Attributes - `ip_address` string: The IP address of the user. - `user_agent` string: The user agent of the User. - `trusted_metadata` object: The `trusted_metadata` field contains an arbitrary JSON object of application-specific data. See the [Metadata](https://stytch.com/docs/api/metadata) reference for complete field behavior details. - `untrusted_metadata` object: The `untrusted_metadata` field contains an arbitrary JSON object of application-specific data. Untrusted metadata can be edited by end users directly via the SDK, and **cannot be used to store critical information.** See the [Metadata](https://stytch.com/docs/api/metadata) reference for complete field behavior details. - `external_id` string: An identifier that can be used in API calls wherever a user_id is expected. This is a string consisting of alphanumeric, `.`, `_`, `-`, or `|` characters with a maximum length of 128 characters. - `roles` string[]: Roles to explicitly assign to this User. See the [RBAC guide](https://stytch.com/docs/guides/rbac/role-assignment) for more information about role assignment. ## Response `200` Successful response - ApiUserV1UpdateResponse - `request_id` string, required: Globally unique UUID that is returned with every API call. This value is important to log for debugging purposes; we may ask for this value to help identify a specific API call when helping you debug an issue. - `user_id` string, required: The unique ID of the updated User. - `emails` ApiUserV1Email[], required: An array of email objects for the User. - `email_id` string, required: The unique ID of a specific email address. - `email` string, required: The email address. - `verified` boolean, required: The verified boolean denotes whether or not this send method, e.g. phone number, email address, etc., has been successfully authenticated by the User. - `phone_numbers` ApiUserV1PhoneNumber[], required: An array of phone number objects linked to the User. - `phone_id` string, required: The unique ID for the phone number. - `phone_number` string, required: The phone number. - `verified` boolean, required: The verified boolean denotes whether or not this send method, e.g. phone number, email address, etc., has been successfully authenticated by the User. - `crypto_wallets` ApiUserV1CryptoWallet[], required: An array contains a list of all crypto wallets for a given User in the Stytch API. - `crypto_wallet_id` string, required: The unique ID for a crypto wallet - `crypto_wallet_address` string, required: The actual blockchain address of the User's crypto wallet. - `crypto_wallet_type` string, required: The blockchain that the User's crypto wallet operates on, e.g. Ethereum, Solana, etc. - `verified` boolean, required: The verified boolean denotes whether or not this send method, e.g. phone number, email address, etc., has been successfully authenticated by the User. - `user` ApiUserV1User, required - `user_id` string, required: The unique ID of the affected User. - `emails` ApiUserV1Email[], required: An array of email objects for the User. - `email_id` string, required: The unique ID of a specific email address. - `email` string, required: The email address. - `verified` boolean, required: The verified boolean denotes whether or not this send method, e.g. phone number, email address, etc., has been successfully authenticated by the User. - `status` string, required: The status of the User. The possible values are `pending` and `active`. - `phone_numbers` ApiUserV1PhoneNumber[], required: An array of phone number objects linked to the User. - `phone_id` string, required: The unique ID for the phone number. - `phone_number` string, required: The phone number. - `verified` boolean, required: The verified boolean denotes whether or not this send method, e.g. phone number, email address, etc., has been successfully authenticated by the User. - `webauthn_registrations` ApiUserV1WebAuthnRegistration[], required: An array that contains a list of all Passkey or WebAuthn registrations for a given User in the Stytch API. - `webauthn_registration_id` string, required: The unique ID for the Passkey or WebAuthn registration. - `domain` string, required: The `domain` on which Passkey or WebAuthn registration was started. This will be the domain of your app. - `user_agent` string, required: The user agent of the User. - `verified` boolean, required: The verified boolean denotes whether or not this send method, e.g. phone number, email address, etc., has been successfully authenticated by the User. - `authenticator_type` string, required: The `authenticator_type` string displays the requested authenticator type of the Passkey or WebAuthn device. The two valid types are "platform" and "cross-platform". If no value is present, the Passkey or WebAuthn device was created without an authenticator type preference. - `name` string, required: The `name` of the Passkey or WebAuthn registration. - `providers` ApiUserV1OAuthProvider[], required: An array of OAuth `provider` objects linked to the User. - `provider_type` string, required: Denotes the OAuth identity provider that the user has authenticated with, e.g. Google, Facebook, GitHub etc. - `provider_subject` string, required: The unique identifier for the User within a given OAuth provider. Also commonly called the "sub" or "Subject field" in OAuth protocols. - `profile_picture_url` string, required: If available, the `profile_picture_url` is a url of the User's profile picture set in OAuth identity the provider that the User has authenticated with, e.g. Facebook profile picture. - `locale` string, required: If available, the `locale` is the User's locale set in the OAuth identity provider that the user has authenticated with. - `oauth_user_registration_id` string, required: The unique ID for an OAuth registration. - `totps` ApiUserV1TOTP[], required: An array containing a list of all TOTP instances for a given User in the Stytch API. - `totp_id` string, required: The unique ID for a TOTP instance. - `verified` boolean, required: The verified boolean denotes whether or not this send method, e.g. phone number, email address, etc., has been successfully authenticated by the User. - `crypto_wallets` ApiUserV1CryptoWallet[], required: An array contains a list of all crypto wallets for a given User in the Stytch API. - `crypto_wallet_id` string, required: The unique ID for a crypto wallet - `crypto_wallet_address` string, required: The actual blockchain address of the User's crypto wallet. - `crypto_wallet_type` string, required: The blockchain that the User's crypto wallet operates on, e.g. Ethereum, Solana, etc. - `verified` boolean, required: The verified boolean denotes whether or not this send method, e.g. phone number, email address, etc., has been successfully authenticated by the User. - `biometric_registrations` ApiUserV1BiometricRegistration[], required: An array that contains a list of all biometric registrations for a given User in the Stytch API. - `biometric_registration_id` string, required: The unique ID for a biometric registration. - `verified` boolean, required: The verified boolean denotes whether or not this send method, e.g. phone number, email address, etc., has been successfully authenticated by the User. - `is_locked` boolean, required: Whether the User is temporarily locked due to too many failed authentication attempts. See the [User Locking Guide](https://stytch.com/docs/resources/platform/user-locks) for more information. - `roles` string[], required: Roles assigned to this User. See the [RBAC guide](https://stytch.com/docs/guides/rbac/role-assignment) for more information about role assignment. - `name` ApiUserV1Name - `first_name` string: The first name of the user. - `middle_name` string: The middle name(s) of the user. - `last_name` string: The last name of the user. - `created_at` string: The timestamp of the User's creation. Values conform to the RFC 3339 standard and are expressed in UTC, e.g. `2021-12-29T12:33:09Z`. - `password` ApiUserV1Password - `password_id` string, required: The unique ID of a specific password - `requires_reset` boolean, required: Indicates whether this password requires a password reset - `trusted_metadata` object: The `trusted_metadata` field contains an arbitrary JSON object of application-specific data. See the [Metadata](https://stytch.com/docs/api/metadata) reference for complete field behavior details. - `untrusted_metadata` object: The `untrusted_metadata` field contains an arbitrary JSON object of application-specific data. Untrusted metadata can be edited by end users directly via the SDK, and **cannot be used to store critical information.** See the [Metadata](https://stytch.com/docs/api/metadata) reference for complete field behavior details. - `external_id` string: An identifier that can be used in most API calls where a `member_id` is expected. This is a string consisting of alphanumeric, `.`, `_`, `-`, or `|` characters with a maximum length of 128 characters. External IDs must be unique within the project. - `lock_created_at` string: When the user lock was created, if there is one. Values conform to the RFC 3339 standard and are expressed in UTC, e.g. `2021-12-29T12:33:09Z`. - `lock_expires_at` string: When the user lock expires, if there is one. Values conform to the RFC 3339 standard and are expressed in UTC, e.g. `2021-12-29T12:33:09Z`. - `status_code` integer, required: The HTTP status code of the response. Stytch follows standard HTTP response status code patterns, e.g. 2XX values equate to success, 3XX values are redirects, 4XX are client errors, and 5XX are server errors. ## Other responses - `400`: Bad request - `401`: Unauthorized - `429`: Too Many Requests - `500`: Internal server error ## Changes - **2026-03-07** `110f26a94e5b`: 1 info - endpoint added - **2026-03-06** `9cab20b8eca7`: 1 breaking - api path removed without deprecation - **2026-01-09** `7dfcc14e566c`: 4 breaking, 1 warning - the `trusted_metadata` request property type changed from `string` to `object` - the `untrusted_metadata` request property type changed from `string` to `object` - the `user/trusted_metadata` response's property type changed from `string` to `object` for status `200` - the `user/untrusted_metadata` response's property type changed from `string` to `object` for status `200` - …1 more - **2025-11-03** `b2acbf387799`: 1 breaking - added the new required request property `user_id` - **2025-10-24** `69e827881158`: 1 warning - removed the request property `user_id` [Operation history](https://skmtc.dev/stytch/apis/stytch-api/changes/v1/users/:user_id/put.md) --- [API](https://skmtc.dev/stytch/apis/stytch-api.md) - [All operations](https://skmtc.dev/stytch/apis/stytch-api/llms.txt) - [OpenAPI document](https://skmtc.dev/stytch/apis/stytch-api/revisions/6d1ff7474803?raw)