Change a member’s role

PATCH

/orgs/{org}/members/{userId}

curl --request PATCH \
  --url https://api.sloose.com/orgs/org_9f3c/members/usr_4b19 \
  --header 'Authorization: Bearer <token>' \
  --header 'Content-Type: application/json' \
  --data '{ "role": "operator" }'

• Production
• Staging

Sets the role, and marks it as manually assigned so signing in again does not undo it — which matters on an org that follows Zoho profiles, where the next sign-in would otherwise reset what you just decided.

You may lower your own role but not raise it, you cannot change somebody who outranks you, and you cannot leave the org without an owner.

Authorizations

• sessionAuth
• apiTokenAuth

Parameters

Path Parameters

org

required

The org id the session was issued for. A token for one org can never read another.

string

Example

org_9f3c

The org id the session was issued for. A token for one org can never read another.

userId

required

The member’s user id, from the member list.

string

Example

usr_4b19

The member’s user id, from the member list.

Request Body^required

Media typeapplication/json

object

role

required

Ranked: operator < builder < admin < owner.

string

Allowed values: operator builder admin owner

Responses

200

The member as they now stand.

Media typeapplication/json

object

member

required

object

userId

required

string

email

required

string

displayName

required

string | null

role

required

string

Allowed values: operator builder admin owner

roleSource

required

Where the role came from: the CRM profile at sign-in, or set by hand here. A manual role is not reset by signing in again.

string | null

zohoProfile

required

string | null

externalUserId

required

How the org’s CRM knows this member — the Zoho user id. Null for someone who joined another way.

string | null

lastSeenAt

required

string | null

blockedAt

required

When access was revoked. Null while they can still use the org.

string | null

key

additional properties

Example

{
  "member": {
    "role": "operator"
  }
}

400

The request body did not match the schema. issues carries the Zod issue list.

Media typeapplication/json

The error envelope every non-2xx answer uses.

object

error

required

Human-readable explanation.

string

code

Machine-readable reason. Absent on a few legacy 400s.

string

key

additional properties

Example^generated

{
  "error": "example",
  "code": "example"
}

401

No bearer, or one that is expired, revoked or no longer resolves to a member.

Media typeapplication/json

The error envelope every non-2xx answer uses.

object

error

required

Human-readable explanation.

string

code

Machine-readable reason. Absent on a few legacy 400s.

string

key

additional properties

Example^generated

{
  "error": "example",
  "code": "example"
}

403

You tried to raise your own role (SELF_CHANGE), or to change somebody who outranks you or grant a role above your own (OUTRANKED).

Media typeapplication/json

The error envelope every non-2xx answer uses.

object

error

required

Human-readable explanation.

string

code

Machine-readable reason. Absent on a few legacy 400s.

string

key

additional properties

Example^generated

{
  "error": "example",
  "code": "example"
}

404

That person is not in this org (MEMBER_NOT_FOUND).

Media typeapplication/json

The error envelope every non-2xx answer uses.

object

error

required

Human-readable explanation.

string

code

Machine-readable reason. Absent on a few legacy 400s.

string

key

additional properties

Example^generated

{
  "error": "example",
  "code": "example"
}

409

The org would be left with no owner (LAST_OWNER), or their access is revoked and must be restored first (ACCESS_REVOKED).

Media typeapplication/json

The error envelope every non-2xx answer uses.

object

error

required

Human-readable explanation.

string

code

Machine-readable reason. Absent on a few legacy 400s.

string

key

additional properties

Example^generated

{
  "error": "example",
  "code": "example"
}