Skip to content
dropin

Change a teammate's role — owner only

PATCH
/operator/team/{id}
curl --request PATCH \
  --url http://localhost:3000/operator/team/example \
  --header 'Authorization: Bearer <token>' \
  --header 'Content-Type: application/json' \
  --data '{ "role": "owner" }'

The id must name an operator on the caller’s own tenant; anything else is 403, never a 404 that would confirm the id exists somewhere else. An operator may not change their own role — self-demotion is self-lockout one step removed.

Authorizations

Section titled “Authorizations”

Parameters

Section titled “Parameters”

Path Parameters

Section titled “Path Parameters”
id
required
string

Request Bodyrequired

Section titled “Request Bodyrequired”
Media typeapplication/json
object
role
required
string
Allowed values: owner member

Responses

Section titled “Responses”

200

Section titled “200”

The updated teammate.

Media typeapplication/json

An operator on the caller’s own tenant. invite_pending is true until they accept their invite and set a password. No password material is ever returned.

object
id
required
string
email
required
string format: email
name
required
string
role
required
string
Allowed values: owner member
status
required
string
Allowed values: active disabled
created_at
required
string format: date-time
invite_pending
required
boolean
Example
{
  "role": "owner",
  "status": "active"
}

400

Section titled “400”

Invalid body

Media typeapplication/json
object
error
required
object
code
required
string
Allowed values: VALIDATION_FAILED UNAUTHENTICATED FORBIDDEN NOT_FOUND CONFLICT RATE_LIMITED INTERNAL
message
required
string
requestId
required
string
fields

Present only for VALIDATION_FAILED.

Array<object>
object
path
string
message
string
Example
{
  "error": {
    "code": "VALIDATION_FAILED"
  }
}

401

Section titled “401”

Invalid, expired, revoked, or absent token.

Media typeapplication/json
object
error
required
object
code
required
string
Allowed values: VALIDATION_FAILED UNAUTHENTICATED FORBIDDEN NOT_FOUND CONFLICT RATE_LIMITED INTERNAL
message
required
string
requestId
required
string
fields

Present only for VALIDATION_FAILED.

Array<object>
object
path
string
message
string
Example
{
  "error": {
    "code": "VALIDATION_FAILED"
  }
}

403

Section titled “403”

Caller is not an owner, the id belongs to another tenant, or the caller is acting on their own row.

Media typeapplication/json
object
error
required
object
code
required
string
Allowed values: VALIDATION_FAILED UNAUTHENTICATED FORBIDDEN NOT_FOUND CONFLICT RATE_LIMITED INTERNAL
message
required
string
requestId
required
string
fields

Present only for VALIDATION_FAILED.

Array<object>
object
path
string
message
string
Example
{
  "error": {
    "code": "VALIDATION_FAILED"
  }
}

409

Section titled “409”

The change would leave the tenant with no active owner, so nobody could ever invite or promote anyone again. The message names that reason in words the operator can act on — a deliberate exception to the terse-error rule, because it leaks nothing they cannot already see on the page.

Media typeapplication/json
object
error
required
object
code
required
string
Allowed values: VALIDATION_FAILED UNAUTHENTICATED FORBIDDEN NOT_FOUND CONFLICT RATE_LIMITED INTERNAL
message
required
string
requestId
required
string
fields

Present only for VALIDATION_FAILED.

Array<object>
object
path
string
message
string
Example
{
  "error": {
    "code": "VALIDATION_FAILED"
  }
}