---
title: "Update a custom instance role"
method: PUT
path: "/admin/roles/{roleId}"
tags: ["Admin"]
---

# Update a custom instance role

`PUT /admin/roles/{roleId}`

## Request

- Base URL: `https://cloud.kaneo.app/api`
- URL: `https://cloud.kaneo.app/api/admin/roles/{roleId}`
- Auth: HTTP bearer

Rename a role or replace its permissions. Users who have it keep it under the new name, and permission changes apply to their next request. Requires the `roles:manage` permission; API keys are rejected.

## Path parameters

- `roleId` string, required

## Request body

- object
  - `name` string, required: Lowercase letters, digits and hyphens, starting with a letter. `admin` and `user` are reserved.
  - `permissions` string[], required: Instance permissions the role grants. `roles:manage` belongs to the built-in admin role only.

## Response `200`

The updated role

- InstanceRole
  - `id` string, required
  - `name` string, required
  - `permissions` string[], required
  - `userCount` integer, required: Users who currently have this role.
  - `createdAt` string, date-time, required
  - `updatedAt` string, date-time, required

## Other responses

- `400`: Invalid name or permission
- `401`: Missing or invalid credentials
- `403`: The caller lacks the instance permission or used an API key
- `404`: Role not found
- `409`: The name is taken, reserved, or already held by users
- `429`: The API key exceeded its rate limit or usage quota. Wait the number of seconds in Retry-After before retrying. The X-RateLimit headers are sent only when the rate limit was hit.

## Changes

- **2026-10-27** `8f3ec578c70a`: 1 info
  - endpoint added

[Operation history](https://skmtc.dev/usekaneo/apis/kaneo-api/changes/admin/roles/:roleId/put.md)

---

[API](https://skmtc.dev/usekaneo/apis/kaneo-api.md) - [All operations](https://skmtc.dev/usekaneo/apis/kaneo-api/llms.txt) - [OpenAPI document](https://skmtc.dev/usekaneo/apis/kaneo-api/revisions/741a49dfb347?raw)