Skip to main content
This endpoint changes an active human member’s workspace system role by email. Send member, editor, or admin. Pass custom role IDs in customRoleIds to replace that member’s custom roles. The call is authorized by the workspace API key’s USER_MANAGEMENT_API scope. It does not run as the person who created the key, so it keeps working after that admin leaves the workspace.

Base URL

Dedicated deploymentsReplace api.langdock.com with <your-deployment-url>/api/public in all requests.

Prerequisites

  • API Key with the USER_MANAGEMENT_API scope
  • The API key must be created by a workspace admin

Behavior

  • Omit customRoleIds? On member or editor, the member’s current custom roles stay.
  • Send customRoleIds? The list replaces those roles. [] removes every custom role. Send at most 15 IDs. Get them from List Roles. Duplicate IDs count toward that limit and are applied once.
  • An ID in customRoleIds is not a UUID, or the list has more than 15 IDs? Returns 400 and changes nothing.
  • Unknown, deleted, or another workspace’s custom role? Returns 400 with code: "BAD_REQUEST" and message Unknown custom role. Nothing is written.
  • Promote to admin? Custom roles and extra permissions are removed, even if you omit customRoleIds.
  • customRoleIds is not empty, and role is admin? Returns 400 with code: "BAD_REQUEST" and message Admins already have every permission. Custom roles can only be assigned to members and editors. Nothing is written.
  • Extra permissions on member or editor? They stay. This call cannot set them.
  • The response customRoleIds lists the custom roles the member has after the call, ordered by when each role was assigned.
  • Not an active human member? Returns 404 (unknown email, invited, deactivated, service account, or another workspace).
  • Last remaining admin? Returns 400 with code: "BAD_REQUEST".
  • Repeating the member’s current role succeeds.
  • Email matching is case-insensitive. Role values are lowercase: member, editor, admin. ADMIN returns 400.
Langdock intentionally blocks browser-origin requests to protect your API key and ensure your applications remain secure. For more information, please see our guide on API Key Best Practices.