PATCH /v1/console/orgs/{org_id}/members/{user_id}

Call	PATCH /v1/console/orgs/{org_id}/members/{user_id}
Price	free
Scope	console session cookie (not an API key)
Operation id	updateMember

What it does

Change a member’s role. Only an owner may grant owner or change an owner’s role, and the last owner cannot be demoted (409). Audited as member_role_changed. Roles: owner, admin (checked server-side). When the user has TOTP on, the session must have passed POST /v1/console/totp/verify; an owner of an organization with more than one member must have TOTP on (spec 9.1), otherwise 403.

Example request

Copy it as curl. Set VERDICT_API_KEY first; uuidgen makes a fresh Idempotency-Key.

Request

curl -X PATCH 'https://api.askverdict.io/v1/console/orgs/org_01JC3Z4Y8R9K2M5N7P1Q3S5T7V/members/usr_01JC3Z4Y8R9K2M5N7P1Q3S5T7V' \
  --cookie "verdict_session=$VERDICT_SESSION" \
  -H 'Content-Type: application/json' \
  -d '{
  "role": "admin"
}'

Example response

200: The member, updated.

200 response

{
  "user_id": "usr_01JC3Z4Y8R9K2M5N7P1Q3S5T7V",
  "email": "[email protected]",
  "role": "admin",
  "totp_enabled": true,
  "joined_at": "2026-11-01T09:00:00Z"
}

Parameters

Name	In	Type	Required	Description
org_id	path	string	yes	The organization.
user_id	path	string	yes	The member’s user id.
x-verdict-version	header	string	no	API version to use, a date. Defaults to the version current when the key was created. The current version is 2026-11-01.

Request body

Schema UpdateMemberRequest. The new role.

Field	Type	Required	Description
role	enum: “owner”, “admin”, “developer”, “billing”, “read_only”	yes	The new role. Only an owner may grant or remove owner.

Response fields (200)

Schema Member.

Field	Type	Required	Description
user_id	string	yes	The member’s user id.
email	string (email)	yes	The member’s email.
role	enum: “owner”, “admin”, “developer”, “billing”, “read_only”	yes	The member’s role.
totp_enabled	boolean	yes	Whether the member has TOTP on.
joined_at	string (date-time)	yes	When the member joined.

Errors

Errors are RFC 9457 problem details and are never billed. Branch on type. See Errors.

Status	Meaning
400	Invalid request: malformed JSON, an unknown field, a failed constraint or a size limit (invalid_request).
401	Missing, malformed, revoked or expired API key, or a bad webhook signature (unauthorized).
403	The key lacks the scope this operation needs (forbidden_scope).
404	The resource does not exist in this organization (not_found).
409	The Idempotency-Key was reused with a different request, or the first request is still running (idempotency_conflict).
429	Rate limited (rate_limited). Wait Retry-After seconds.
500	Unexpected server error (internal). Not billed; retry with the same Idempotency-Key.

Try it

Open the interactive reference to send this request from the browser. The full document is at /openapi.json.