Skip to main content
POST
Update member permissions

Authorizations

Authorization
string
header
required

OAuth 2.1 authorization code + PKCE (S256). Tokens are tenant-bound (company_id) and scoped. Discover endpoints via /.well-known/oauth-authorization-server.

Body

application/json

Update a team member's role / permissions / email preferences. companyId is injected from the token tenant and must NOT be supplied. Required (validated in the use-case): memberUserId. Source: lib/api/team/update-permissions.usecase.ts + update_member_permissions call.body. The route zod (UpdatePermissionsInput) is .passthrough(). When role is Admin/Owner the platform forces full permissions regardless of the supplied permissions.

memberUserId
string
required

User id of the member to update.

Minimum string length: 1
role
enum<string>

New role; defaults to the member's current role when omitted.

Available options:
Owner,
Admin,
Employee
permissions
object

Team permissions share the public capability scope vocabulary. When scopes is present it is the exact grant, including an empty array for no access, and the boolean fields are compatibility projections. Owners always retain full access. Admin and Employee grants can be customized. Omitting scopes retains the legacy permission behavior. A caller cannot grant more access than they hold.

emailPreferences
object

Per-member email-notification preferences. Source: lib/team-email-preferences.ts TEAM_EMAIL_PREFERENCE_KEYS + normalizeTeamEmailPreferences (always returns the closed key set).

propagateToAgency
boolean

Propagate the update across agency companies (default false).

Response

Updated permissions / email preferences and the agency-propagation summary (null when not propagated).

data
object
required

Update-permissions result. Source: UpdatePermissionsResult (lib/api/team/update-permissions.usecase.ts). propagation is null unless propagateToAgency was set and propagation succeeded.