Skip to content

Menu

API reference · Organizations

Change a member's role

PATCH/v1/orgs/{org}/members/{user}

Permission: org.members.update
Audit log: org.member.role_change
Operation: org.members.update

Parameters

Name	In	Type	Required	Notes
`org`	path	string	yes	for example `"org_01h455vb4pex5vsknk084sn02q"`
`user`	path	string	yes	for example `"user_01h455vb4pex5vsknk084sn02q"`
`Idempotency-Key`	header	string	no	One key per intended mutation. A retry with the key replays the recorded response instead of executing again; the key with another request answers 422 idempotency_key_reused. For example `"01h455vb4pex5vsknk084sn02q"`
`x-obhut-management-assignment`	header	string	no	Select one staff assignment. Direct membership remains the default. Bound API tokens use their stored source and ignore this selector. For example `"masg_01h455vb4pex5vsknk084sn02q"`

Request body

Field	Type	Required	Notes
`role`	string	yes	one of `"owner"`, `"admin"`, `"member"`

Response 200

Field	Type	Required	Notes
`userId`	string	yes	for example `"user_01h455vb4pex5vsknk084sn02q"`
`role`	string	yes	one of `"owner"`, `"admin"`, `"member"`
`joinedAt`	string (date-time)	yes	UTC, ISO 8601.

Request shaped from the schemas

curl

curl -X PATCH 'https://api.obhut.io/v1/orgs/org_01h455vb4pex5vsknk084sn02q/members/user_01h455vb4pex5vsknk084sn02q' \
  -H "Authorization: Bearer $OBHUT_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{
  "role": "owner"
}'

Response 200

{
  "userId": "user_01h455vb4pex5vsknk084sn02q",
  "role": "owner",
  "joinedAt": "2026-01-01T12:00:00.000Z"
}