# Update user

Update a member's roles or authentication settings.

Source: https://statusdashboard.com/docs/api/account-management/users/update

`PATCH /app/users/{email}`

Updates a single org member's roles and password-authentication setting.

The `roles` field replaces the member's entire role list — it is not additive. An admin cannot remove their own admin role, and the last admin in an organization cannot lose their admin role.

The `email` path parameter must be URL-encoded (`@` → `%40`).

***

## Path parameters
| Parameter | Type   | Description                                        |
| --------- | ------ | -------------------------------------------------- |
| `email`   | string | URL-encoded email address of the member to update. |

***

## Request
See [API Basics](/docs/api) for required headers.

### Request body
| Field               | Type      | Required | Description                                                                                                                                 |
| ------------------- | --------- | -------- | ------------------------------------------------------------------------------------------------------------------------------------------- |
| `roles`             | string\[] | Yes      | Full replacement role list. Allowed values: `"admin"`, `"event"`, `"subscriber"`.                                                           |
| `allowPasswordAuth` | boolean   | No       | Whether the user may authenticate with email and password. Set to `false` for SSO-only access — requires at least one enabled SSO provider. |
| `disabled`          | boolean   | No       | When `true`, blocks all sign-in and API access while preserving the membership record.                                                      |

***

## Sample request
```bash
curl -X PATCH https://api.statusdashboard.com/app/users/bob%40acmeplumbing.com \
  -H "Authorization: Bearer bcf847abf5c6:def456" \
  -H "Content-Type: application/json" \
  -d '{"roles": ["admin", "event"]}'
```

## Sample response
**Status: `200 OK`**

```json
{
  "user": {
    "email": "bob@acmeplumbing.com",
    "roles": ["admin", "event"],
    "allowPasswordAuth": true,
    "disabled": false
  }
}
```

***

## Error responses
| Status | When                                                                                                                               |
| ------ | ---------------------------------------------------------------------------------------------------------------------------------- |
| `400`  | Validation failure, self-lockout attempt (removing own admin role), or SSO provider not configured for `allowPasswordAuth: false`. |
| `403`  | Insufficient permissions.                                                                                                          |
| `404`  | No member with that email exists in the organization.                                                                              |
| `409`  | Self-disable attempt, disabling the only admin, or removing admin role from the only admin.                                        |