Skip to main content
POST
Update member permissions

Authorizations

Authorization
string
header
required

OAuth 2.1 authorization code + PKCE (S256). Tokens are tenant-bound (company_id) and scoped. Discover endpoints via /.well-known/oauth-authorization-server.

Body

application/json

Update a team member's role / permissions / email preferences. companyId is injected from the token tenant and must NOT be supplied. Required (validated in the use-case): memberUserId. Source: lib/api/team/update-permissions.usecase.ts + update_member_permissions call.body. The route zod (UpdatePermissionsInput) is .passthrough(). When role is Admin/Owner the platform forces full permissions regardless of the supplied permissions.

memberUserId
string
required

User id of the member to update.

Minimum string length: 1
role
enum<string>

New role; defaults to the member's current role when omitted.

Available options:
Owner,
Admin,
Employee
permissions
object

Per-member permission flags (9-key boolean set). Each key defaults to true when omitted. Source: lib/team-permissions.ts TEAM_PERMISSION_KEYS + normalizeTeamPermissions (always returns all 9 keys).

emailPreferences
object

Per-member email-notification preferences. Source: lib/team-email-preferences.ts TEAM_EMAIL_PREFERENCE_KEYS + normalizeTeamEmailPreferences (always returns the closed key set).

propagateToAgency
boolean

Propagate the update across agency companies (default false).

Response

Updated permissions / email preferences and the agency-propagation summary (null when not propagated).

data
object
required

Update-permissions result. Source: UpdatePermissionsResult (lib/api/team/update-permissions.usecase.ts). propagation is null unless propagateToAgency was set and propagation succeeded.