---
title: "Update User"
method: PUT
path: "/users/{userId}"
tags: ["Users"]
---

# Update User

`PUT /users/{userId}`

## Request

- Base URL: `https://env.unqork.io/api/1.0`
- URL: `https://env.unqork.io/api/1.0/users/{userId}`
- Auth: OAuth 2
  - Client credentials
  - Password
  - Token URL: `https://xyzfinancial.unqork.io/api/1.0/oauth2/access_token`
- TypeScript: <https://skmtc.dev/unqork/apis/unqork-customer-api/docs/users/:userId/put.ts> (a function with typed inputs; its response is checked against the schema)

Updates a single user. Partial updates are supported. To delete a specific custom attribute, pass null for that attribute.
### Authorization Required:
  - Designer Administrator

## Path parameters

- `userId` string, required

## Query parameters

- `shouldNotify` boolean

## Request body

- UserPut
  - `userId` string: The unique identifier of the user account. The userId can only include letters, numbers, and the following characters @,+-_. **Immutable**: This value cannot be modified. If provided in the request body, it must match the `userId` in the path, or it will be ignored.
  - `name` string: The name can only include letters, numbers, and the following characters @,+-_.'
  - `email` string, email: Quotes and special characters `"(),:;<>@[]\` are not allowed. The local portion of the email (e.g. local@domain.com) must be > 0 characters and < 64 charaters. There cannot be consecutive dots (e.g. `..`) in the email
  - `phone` string: Must be a valid US phone number unless the country code is specified, in which case it is validated with [libphonenumber-js](https://gitlab.com/catamphetamine/libphonenumber-js#definitions)
  - `role` string: One of the roles configured in Unqork
  - `expressRoles` string[]: Express roles configured in Unqork
  - `groups` string[]: List of groups configured in Unqork OR comma-separated list of groups configured in Unqork (e.g. "group1,group2")
  - `applicationRoles` object: Map of applications to roles OR comma-separated list of application-role mappings (e.g. "application1:role1,application2:role2")
  - `password` string, password: Complexity is enforced from the environment's password requirements, so the effective bounds are per-environment rather than fixed. Read that configuration for the values that apply; the platform defaults are a minimum length of 12, a maximum of 64, and at least one lowercase letter, one uppercase letter, one number, and one symbol. Service users (`isServiceUser: true`) are the exception - their minimum length is forced to 32 and their maximum to 64, overriding whatever the environment configures, and all four character classes are always required.
  - `isServiceUser` boolean
  - `...customAttributes` string: Custom attributes can be included as additional keys in the request body. Only string values of custom attributes are supported - an object value is rejected with `400 Invalid attribute "<key>": Object not allowed`. Reserved keys are silently dropped rather than rejected, so a custom attribute must not reuse one of: `userId`, `email`, `phone`, `name`, `role`, `password`, `created`, `modified`, `passwordHash`, `passwordHistory`, `passwordStatus`, `passwordExpiry`, `credentialExpired`, `groups`, `applicationRoles`, `lastLogin`, `isServiceUser`, `designerRoles`, `expressRoles`, `isUserLocked`, `description`, `clientSecret`.

## Response `200`

User updated

- UserResponse
  - `userId` string, required
  - `name` string, required
  - `email` string, required
  - `phone` string
  - `role` string: One of the roles configured in Unqork
  - `expressRoles` string[]: Express roles configured in Unqork
  - `groups` string[]: List of groups configured in Unqork
  - `applicationRoles` object: Map of applications to roles
  - `created` string, date-time, required
  - `modified` string, date-time, required
  - `isServiceUser` boolean
  - `lastLogin` string, date-time
  - `...customAttributes` string: Custom attributes will be included as additional keys in the response body.

## Other responses

- `default`: Error

## Changes

- **2026-08-10** `112399a67ebb`: 1 breaking
  - for the `query` request parameter `shouldNotify`, default value `true` was added

[Operation history](https://skmtc.dev/unqork/apis/unqork-customer-api/changes/users/:userId/put.md)

---

[API](https://skmtc.dev/unqork/apis/unqork-customer-api.md) - [All operations](https://skmtc.dev/unqork/apis/unqork-customer-api/llms.txt) - [OpenAPI document](https://skmtc.dev/unqork/apis/unqork-customer-api/revisions/13dad4096373?raw)