Update User

Update properties of an existing user. All fields are optional.

Request

PATCH https://api.entryguard.io/api/v1/users/{id}

Authentication

Requires a valid Bearer JWT token with ORG_ADMIN role.

Authorization: Bearer <access_token>

Path Parameters

Parameter	Type	Required	Description
id	UUID	Yes	The unique identifier of the user to update

Request Body

{
  "name": "string",
  "isOrgAdmin": "boolean",
  "isActive": "boolean"
}

Field	Type	Required	Description
name	string	No	New user name
isOrgAdmin	boolean	No	Whether to grant/revoke organization admin privileges
isActive	boolean	No	Whether to activate/deactivate the user account

All fields are optional. Only provided fields will be updated.

Response

Returns the updated user object.

Response Schema

{
  "id": "uuid",
  "email": "string",
  "name": "string",
  "isOrgAdmin": "boolean",
  "platformRole": "string",
  "isActive": "boolean",
  "mfaEnabled": "boolean",
  "lastLoginAt": "timestamp",
  "roleNames": ["string"],
  "createdAt": "timestamp",
  "updatedAt": "timestamp"
}

Success Response

Status Code: 200 OK

{
  "id": "770e8400-e29b-41d4-a716-446655440004",
  "email": "[email protected]",
  "name": "Robert Developer",
  "isOrgAdmin": false,
  "platformRole": "CUSTOMER",
  "isActive": true,
  "mfaEnabled": false,
  "lastLoginAt": "2026-02-17T14:20:00Z",
  "roleNames": ["Backend Developers"],
  "createdAt": "2026-01-20T11:30:00Z",
  "updatedAt": "2026-02-18T10:30:00Z"
}

Error Responses

Status Code	Description
400 Bad Request	Invalid request body or attempting to demote the last admin
401 Unauthorized	Missing or invalid authentication token
403 Forbidden	User does not have ORG_ADMIN role
404 Not Found	User with the specified ID does not exist in this organization
429 Too Many Requests	Rate limit exceeded
500 Internal Server Error	Server error occurred

Error Response Examples:

{
  "timestamp": "2026-02-18T10:30:00Z",
  "status": 400,
  "error": "Bad Request",
  "message": "Cannot demote the last organization admin",
  "path": "/api/v1/users/770e8400-e29b-41d4-a716-446655440003"
}

{
  "timestamp": "2026-02-18T10:30:00Z",
  "status": 404,
  "error": "Not Found",
  "message": "User not found with id: 770e8400-e29b-41d4-a716-446655440004",
  "path": "/api/v1/users/770e8400-e29b-41d4-a716-446655440004"
}

Example

Request

curl -X PATCH https://api.entryguard.io/api/v1/users/770e8400-e29b-41d4-a716-446655440004 \
  -H "Authorization: Bearer eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9..." \
  -H "Content-Type: application/json" \
  -d '{
    "name": "Robert Developer",
    "isActive": true
  }'

Response

{
  "id": "770e8400-e29b-41d4-a716-446655440004",
  "email": "[email protected]",
  "name": "Robert Developer",
  "isOrgAdmin": false,
  "platformRole": "CUSTOMER",
  "isActive": true,
  "mfaEnabled": false,
  "lastLoginAt": "2026-02-17T14:20:00Z",
  "roleNames": ["Backend Developers"],
  "createdAt": "2026-01-20T11:30:00Z",
  "updatedAt": "2026-02-18T10:30:00Z"
}

Notes

• Setting isActive: false will prevent the user from logging in and starting new sessions
• Existing active sessions will continue to run when a user is deactivated
• You cannot demote the last organization admin (must have at least one admin)
• Granting admin privileges (isOrgAdmin: true) gives the user full access to all organization settings