Assign Roles to User

PUT 
/api/users/:user/roles

Syncs the Spatie roles assigned to a user (sanctum guard). Replaces the user's current roles with the provided list.

Not yet available to API tokens

This endpoint currently requires session authentication; Personal Access Token scope support is in progress.

Body fields:

• roles (array of role names; each must exist in roles)

Returns the updated user (including roles and flattened permissions).

Authentication: Requires Bearer token AND the users.update permission (403 Forbidden otherwise).

Errors:

• 403 Forbidden — authenticated user lacks the users.update permission
• 404 Not Found — the target user does not belong to the current tenant (cross-tenant access is rejected)
• 422 Unprocessable Entity — a provided role name does not exist

Requires permission: users.update

Request

Responses

200

OK

Response Headers

Content-Type

401

Unauthenticated — the bearer token is missing, revoked, expired, or malformed. Never retry automatically; fix the credential. See the Errors guide.

403

Forbidden — the token lacks a required scope, the endpoint is not available to API tokens, or the user behind the token lacks the permission. A human must adjust the token scopes or user permissions; do not retry.

404

Not found — no record with the given identifier (or the route does not exist). Verify the ID before retrying.

422

Validation failed — the body is a field → messages map (Laravel shape) or the platform envelope with a stable machine-readable code. Fix the payload and resubmit.

429

Rate limited — platform limit is 1,000 requests/min; individual tokens may carry lower limits. Honor the Retry-After header before retrying. See the Rate Limits guide.