Skip to main content

SetUserRole

POST 
/v1/users/:user_id/role

SetUserRole sets a user's legacy role (authn.user.role) and, in the same transaction, the org binding that the role projects, the platform projection, and the user's binding version, so the new access applies at the next request. A change that is not a promotion to a higher level (a demotion, or a move between roles at the same level) also signs the user out. The change and its audit row commit together, or nothing commits.

Session only. A platform administrator can change a role for any customer_id. Any other caller needs all three: RBAC_AUTH_DB_MODE is "single", customer_id is the deployment customer, and the caller administers that customer. Anyone else gets PERMISSION_DENIED.

FAILED_PRECONDITION: the target is deleted, the target is the caller, the old or the new role is super_admin or admin (use GrantSuperAdmin and RevokeSuperAdmin), or the built-in org role is not seeded yet.

Request​

Responses​

Success