Puts an account in exactly these roles.
Errors
400 when a role identifier is not one, 401 when nothing was signed in,
403 when the caller may not write roles, used a bearer token, or would be
granting a permission they do not hold, 404 when no such account or role,
409 when it would leave no account able to administer the instance.
sessiontessera_session<token>Set by POST /auth/login. A browser sends it automatically; it is HttpOnly, so page scripts cannot read or set it.
id*stringWhich account
application/json- body
Body of PUT /admin/users/{id}/roles.
role?|The role this account should be in, or null for none.
null is signed in and allowed nothing: a real state, and what an empty
list used to mean.
The account as it now stands
application/json- response
One account, as an administrator sees it.
What a user sees of themselves, plus the one thing only an administrator
needs: whether the account may sign in. Users never see their own state
as anything but active, since a disabled account cannot sign in to ask.
email*stringNormalised address.
email_verified_at?|When the address was last proven to reach this user, or null if never.
Set by confirming a registration, by a provider vouching for the
address, or by following the link from
POST /account/email/verification. Cleared when the address changes.
date-timehas_password*booleanWhether the account has a password.
An account created through GitHub, Discord or OIDC has none. It confirms
changes by having signed in within the last few minutes instead of by
typing one, so a client shows a password field only when this is
true; see reauthentication_required.
id*stringStable identifier.
is_admin*booleanWhether the account holds the seeded administrator role.
Kept because clients read it, but derived and not stored, and narrower
than permissions. An account in a role granting users:read
and nothing else is not an administrator, yet reaches one administrative
endpoint. New clients should read permissions.
must_change_password*booleanWhether the account must set a new password before doing anything else.
Set on the administrator generated at first run. A client seeing this should send the user to a change-password screen and nowhere else.
permissions*array<string>Everything this account is allowed to do.
resource:verb strings, and what a client should decide from. A screen
guessing from is_admin is wrong for every role between "member" and
"everything".
quota_bytes?|A storage quota set on this one account, overriding its role's.
null means the role's applies; 0 means this account has no ceiling
of its own. What is actually left is storage_remaining_bytes on
/capabilities, which accounts for what has been used.
int640 <= valueroles*array<string>The roles it is in, by name.
username*stringNormalised account name.
max_file_bytes?|Largest single file for this account, overriding its role's limit.
null means the role's limit applies; 0 means no limit for this
account. Only administrators see it; what a user may actually send is
max_upload_bytes on /capabilities.
int640 <= valuemfa_enabled*booleanWhether signing in with the password asks this account for a code.
So the panel can offer DELETE /admin/users/{id}/mfa only where there
is something to turn off.
state*UserStateWhether it may sign in, or has been deleted.
"active""disabled""deleted"curl -X PUT 'https://example.com/api/v1/admin/users/string/roles' \ -H 'Content-Type: application/json' \ -d '{}'{ "email": "string", "email_verified_at": "2019-08-24T14:15:22Z", "has_password": true, "id": "string", "is_admin": true, "must_change_password": true, "permissions": [ "string" ], "quota_bytes": 0, "roles": [ "string" ], "username": "string", "max_file_bytes": 0, "mfa_enabled": true, "state": "active"}