---
title: "Update User Role"
method: POST
path: "/v2/users/{userId}/roleUpdate"
tags: ["Users"]
---

# Update User Role

`POST /v2/users/{userId}/roleUpdate`

Update the user's Role

## Path parameters

- `userId` string, uuid, required

## Request body

- RoleUpdateRequest
  - `roles` string[], required — <p>The role(s) for the user</p> <p>The role must exist</p> <p>The role can be a custom role or a system role but the invoker must have the permissions to assign the role</p> <p>System roles are: backoffice.admin, payor.master_admin, payor.admin, payor.support</p>
  - `verificationCode` string, nullable — <p>Optional property that MUST be suppied when manually verifying a user</p> <p>The user's smsNumber is registered via a separate endpoint and an OTP sent to them</p>

## Response `204`

request completed okay

## Other responses

- `400` — Invalid request. See Error message payload for details of failure
- `401` — Invalid access token. May be expired or invalid
- `403` — The authentication does not have permissions to access the resource This usually occurs when there is a valid authentication instance (client or user) but they do not have the required permissions
- `404` — The resource was not found or is no longer available

## Changes

- **2020-09-25** `dd71433847a6` — 4 breaking, 24 info
  - the `errors/items/` response's property type/format changed from ``/`` to `object`/`` for status `400`
  - the `errors/items/` response's property type/format changed from ``/`` to `object`/`` for status `401`
  - the `errors/items/` response's property type/format changed from ``/`` to `object`/`` for status `403`
  - the `errors/items/` response's property type/format changed from ``/`` to `object`/`` for status `404`
  - …24 more
- **2020-06-24** `aded220b0d7b` — 2 breaking
  - the response's body type/format changed from `object`/`` to ``/`` for status `404`
  - the `errors/items/` response's property type/format changed from `object`/`` to ``/`` for status `404`
- **2020-01-28** `1b2abf26b5d6` — 1 info
  - endpoint added
- **2019-07-15** `ced8e167a97c` — 1 breaking
  - api path removed without deprecation

[Change history](https://skmtc.dev/velopaymentsapi/apis/velo-payments-apis/changes/v2/users/:userId/roleUpdate/post.md)

---

[API](https://skmtc.dev/velopaymentsapi/apis/velo-payments-apis.md) · [All operations](https://skmtc.dev/velopaymentsapi/apis/velo-payments-apis/llms.txt) · [OpenAPI document](https://skmtc-service-production.skmtc.workers.dev/v1/apis/velopaymentsapi/velo-payments-apis/revisions/05c3f09fc50a/schema)