Skip to main content
POST
This endpoint changes an active human member’s workspace system role by email. Send member, editor, or admin. Pass custom role IDs in customRoleIds to replace that member’s custom roles. The call is authorized by the workspace API key’s USER_MANAGEMENT_API scope. It does not run as the person who created the key, so it keeps working after that admin leaves the workspace.

​
Base URL

Dedicated deploymentsReplace api.langdock.com with <your-deployment-url>/api/public in all requests.

​
Prerequisites

  • API Key with the USER_MANAGEMENT_API scope
  • The API key must be created by a workspace admin

​
Behavior

  • Omit customRoleIds? On member or editor, the member’s current custom roles stay.
  • Send customRoleIds? The list replaces those roles. [] removes every custom role. Send at most 15 IDs. Get them from List Roles. Duplicate IDs count toward that limit and are applied once.
  • An ID in customRoleIds is not a UUID, or the list has more than 15 IDs? Returns 400 and changes nothing.
  • Unknown, deleted, or another workspace’s custom role? Returns 400 with code: "BAD_REQUEST" and message Unknown custom role. Nothing is written.
  • Promote to admin? Custom roles and extra permissions are removed, even if you omit customRoleIds.
  • customRoleIds is not empty, and role is admin? Returns 400 with code: "BAD_REQUEST" and message Admins already have every permission. Custom roles can only be assigned to members and editors. Nothing is written.
  • Extra permissions on member or editor? They stay. This call cannot set them.
  • The response customRoleIds lists the custom roles the member has after the call, ordered by when each role was assigned.
  • Not an active human member? Returns 404 (unknown email, invited, deactivated, service account, or another workspace).
  • Last remaining admin? Returns 400 with code: "BAD_REQUEST".
  • Repeating the member’s current role succeeds.
  • Email matching is case-insensitive. Role values are lowercase: member, editor, admin. ADMIN returns 400.
Langdock intentionally blocks browser-origin requests to protect your API key and ensure your applications remain secure. For more information, please see our guide on API Key Best Practices.

Authorizations

​
Authorization
string
header
required

API key as Bearer token. Format "Bearer YOUR_API_KEY"

Body

application/json
​
email
string<email>
required

Email address of the active workspace member

Example:

"user@example.com"

​
role
enum<string>
required

Workspace system role. Values are lowercase.

Available options:
member,
editor,
admin
Example:

"editor"

​
customRoleIds
string<uuid>[]

Custom role UUIDs from GET /user-management/v1/roles. Omit the field to keep the member's current custom roles, except when role is admin. Send a list, including an empty list, to replace them. At most 15 IDs. Duplicate IDs count toward that limit and are applied once. System role names are not accepted.

Maximum array length: 15

Response

Role updated successfully

​
status
enum<string>
required

Always "success" when the role is updated

Available options:
success
Example:

"success"

​
email
string<email>
required

Email address of the updated member

Example:

"user@example.com"

​
role
enum<string>
required

System role after the update

Available options:
member,
editor,
admin
Example:

"editor"

​
customRoleIds
string<uuid>[]
required

Custom role IDs assigned to the member after this call, ordered by when each role was assigned. Empty after a promotion to admin.