---
title: "Update a user"
method: PUT
path: "/users/{userId}"
tags: ["Users"]
---

# Update a user

`PUT /users/{userId}`

This endpoint updates an API user in Trybe

## Request body

- object
  - `email` string, email — The email address of the user
  - `first_name` string — The user's given name. Shown in the admin UI alongside the surname and used in notification templates as the personalised greeting.
  - `last_name` string — The user's surname. Combined with `first_name` to display a full name in admin lists and email footers.
  - `organisation_id` string, uuid — Identifier of the organisation to scope this user's access to. The caller must have organisation-admin permissions on this organisation; the user will only see sites that belong to it.
  - `cashier_id` string, uuid — Identifier of the cashier record this user is linked to. Cashier IDs map operator activity (sales, refunds, till opens) back to a real person for reporting and audit.
  - `site_ids` string[] — The IDs of the sites to add the user to

## Response `200`

A User

- object — Single-item envelope mixin. `allOf` this into any show response that wraps its `data` payload in an outer object; the concrete schema (e.g. `ShowUser`) adds its own `data` property with the appropriate `$ref` and keeps its own title so the SDK surface is unchanged.
  - `data` User, required
    - `id` string, uuid, required — Stable unique identifier for the user. Treat as opaque even though the underlying format is a UUID — never parse or construct it client-side.
    - `name` string, required — The user's display name, typically `given_name family_name` but may diverge for users who supplied an alternative.
    - `given_name` string, required — The user's first / given name, as supplied at registration or sync from the identity provider.
    - `family_name` string, required — The user's surname / family name, as supplied at registration or sync from the identity provider.
    - `email` string, email, required — The user's primary email address. Used for sign-in, notification delivery, and forms-of-identity verification.
    - `email_verified` boolean, required — Whether the user has verified their email address
    - `organisation_id` string, uuid, required — ID of the organisation this user is scoped to. Every user belongs to exactly one organisation; cross-org access is modelled via separate user accounts.
    - `organisation_name` string, nullable, required — Human-readable name of the user's organisation, denormalised onto the User payload so callers don't need to make a second fetch. `null` when the organisation has been archived.
    - `site_ids` string[], required — The IDs of the sites that this user belongs to
    - `avatar_id` string, uuid, nullable, required — ID of the `Media` record holding the user's avatar image. Use `avatar.urls` on this same payload to render directly without a separate Media fetch. `null` when the user hasn't uploaded one.
    - `avatar` Media
      - `id` string, uuid, required — Unique identifier of the uploaded media item, returned from `createMedia`. Pass this ID into any field that accepts a media reference (logos, hero images, product images, etc.).
      - `file_name` string, required — Original filename of the uploaded asset, preserved as provided at upload time. Used for display in the media library and as a hint when serving downloads.
      - `mime_type` string, required — The mime type of the media item.
      - `original_url` string, required — The url of the media resource.
      - `size` integer, required — The size of the media item in bytes.
      - `url` string, required — The url of the converted media resource.
    - `cashier_id` string, nullable — Optional cashier identifier linking this user to a Point of Sale cashier profile. `null` when the user isn't a POS operator.
    - `status` string, required — Lifecycle status of the user account. `active` for normal sign-in, `disabled` for accounts locked by an admin.
    - `2fa_enabled` boolean — Whether 2FA is enabled for the user
    - `twofa_enabled` boolean, required — Whether 2FA is enabled for the user
    - `created_at` string, date-time, required — The date and time the user was created
    - `updated_at` string, date-time, required — The date and time the user was last updated
    - `managed_by_sso` boolean, required — Whether the user is managed by SSO
    - `whitelisted_internal_user` boolean — Whether the user is a whitelisted internal user

## Other responses

- `401` — The user is unauthenticated
- `403` — The authenticated user does not have permission.
- `404` — The resource couldn't be found
- `422` — The request didn't pass validation

---

[API](https://skmtc.dev/try/apis/trybe-api.md) · [All operations](https://skmtc.dev/try/apis/trybe-api/llms.txt) · [OpenAPI document](https://skmtc-service-production.skmtc.workers.dev/v1/apis/try/trybe-api/revisions/f37f92702da5/schema)