Update member permissions
update a team member’s permissions and role. Requires the team:write scope.
Authorizations
OAuth 2.1 authorization code + PKCE (S256). Tokens are tenant-bound (company_id) and scoped. Discover endpoints via /.well-known/oauth-authorization-server.
Body
Update a team member's role / permissions / email preferences. companyId is injected from the token tenant and must NOT be supplied. Required (validated in the use-case): memberUserId. Source: lib/api/team/update-permissions.usecase.ts + update_member_permissions call.body. The route zod (UpdatePermissionsInput) is .passthrough(). When role is Admin/Owner the platform forces full permissions regardless of the supplied permissions.
User id of the member to update.
1New role; defaults to the member's current role when omitted.
Owner, Admin, Employee Per-member permission flags (9-key boolean set). Each key defaults to true when omitted. Source: lib/team-permissions.ts TEAM_PERMISSION_KEYS + normalizeTeamPermissions (always returns all 9 keys).
Per-member email-notification preferences. Source: lib/team-email-preferences.ts TEAM_EMAIL_PREFERENCE_KEYS + normalizeTeamEmailPreferences (always returns the closed key set).
Propagate the update across agency companies (default false).
Response
Updated permissions / email preferences and the agency-propagation summary (null when not propagated).
Update-permissions result. Source: UpdatePermissionsResult (lib/api/team/update-permissions.usecase.ts). propagation is null unless propagateToAgency was set and propagation succeeded.