---
title: "PUT /orgs/{org_id}/iam/users/roles"
method: PUT
path: "/orgs/{org_id}/iam/users/roles"
tags: ["iam"]
---

# PUT /orgs/{org_id}/iam/users/roles

`PUT /orgs/{org_id}/iam/users/roles`

Replace role attachments for multiple members in one request.

## Path parameters

- `org_id` string, required

## Request body

- BulkReplaceRolesReqBody
  - `users` UserRolesReq[], required — Per-member desired attachment sets. Applied atomically: if any entry is rejected the whole request fails and nothing is written. A member may not appear twice and may not be the caller.
    - `attachments` AttachmentReq[], required — Desired attachment set for this member. Same semantics as the single-member endpoint: a full replace, an empty list detaches everything, duplicate `(role_id, scope)` pairs are ignored.
      - `role_id` integer, required
      - `scope` string, nullable
    - `user_id` integer, required

## Response `204`

Attachments updated

- unknown

## Other responses

- `403` — Insufficient permissions
- `422` — Invalid request

## Changes

- **2026-07-03** `e1c81d0f4235` — 1 info
  - endpoint added
- **2026-03-16** `eb2c08128881` — 1 breaking
  - api path removed without deprecation

[Change history](https://skmtc.dev/timbal-ai/apis/timbal-platform-api/changes/orgs/:org_id/iam/users/roles/put.md)

---

[API](https://skmtc.dev/timbal-ai/apis/timbal-platform-api.md) · [All operations](https://skmtc.dev/timbal-ai/apis/timbal-platform-api/llms.txt) · [OpenAPI document](https://skmtc-service-production.skmtc.workers.dev/v1/apis/timbal-ai/timbal-platform-api/revisions/dd7e398ce0d3/schema)