Skip to main content

Update User

PUT 
/api/users/:user

Updates an existing user. The is_admin field can only be set by admin users.

Tenant scoping: Returns 404 if the user is not a member of the current tenant. Closes a privilege-escalation hole where any tenant admin could otherwise mutate any user system-wide by guessing IDs.

is_admin / is_power_user propagation: when provided, these flags are mirrored to the tenant_users pivot row for the current tenant (the per-tenant source of truth) and also written to the central users columns (for legacy readers). Without this mirror, an admin elevated in one tenant would silently become admin in every tenant they're attached to.

Authentication: Requires Bearer token.

Fields (all optional):

  • name (optional, max:255) — User's full name
  • email (optional, email, max:255) — User's email address
  • is_admin (optional, boolean) — Admin privileges (only settable by admins)
  • is_power_user (optional, boolean) — Power user privileges

Request​

Responses​

Successful response