Users
Update user
Update a member's roles or authentication settings.
PATCH /app/users/{email}
Updates a single org member's roles and password-authentication setting.
The roles field replaces the member's entire role list — it is not additive. An admin cannot remove their own admin role, and the last admin in an organization cannot lose their admin role.
The email path parameter must be URL-encoded (@ → %40).
Path parameters
| Parameter | Type | Description |
|---|---|---|
email | string | URL-encoded email address of the member to update. |
Request
See API Basics for required headers.
Request body
| Field | Type | Required | Description |
|---|---|---|---|
roles | string[] | Yes | Full replacement role list. Allowed values: "admin", "event", "subscriber". |
allowPasswordAuth | boolean | No | Whether the user may authenticate with email and password. Set to false for SSO-only access — requires at least one enabled SSO provider. |
disabled | boolean | No | When true, blocks all sign-in and API access while preserving the membership record. |
Sample request
curl -X PATCH https://api.statusdashboard.com/app/users/bob%40acmeplumbing.com \
-H "Authorization: Bearer bcf847abf5c6:def456" \
-H "Content-Type: application/json" \
-d '{"roles": ["admin", "event"]}'Sample response
Status: 200 OK
{
"user": {
"email": "bob@acmeplumbing.com",
"roles": ["admin", "event"],
"allowPasswordAuth": true,
"disabled": false
}
}Error responses
| Status | When |
|---|---|
400 | Validation failure, self-lockout attempt (removing own admin role), or SSO provider not configured for allowPasswordAuth: false. |
403 | Insufficient permissions. |
404 | No member with that email exists in the organization. |
409 | Self-disable attempt, disabling the only admin, or removing admin role from the only admin. |