---
title: "Edit a user"
method: PATCH
path: "/api/v2/users/{userId}"
tags: ["Users"]
---

# Edit a user

`PATCH /api/v2/users/{userId}`

> 🔑
>
> Required OAuth scope: `users:write`.

Edits specific fields of an existing user. Fields not included in the request payload remain unchanged.

## Path parameters

- `userId` string, ObjectId, required

## Headers

- `360-api-version` 'v2.0', required

## Request body

- UpdateUserDTO
  - `firstName` string, nullable — The first name of the user.
  - `lastName` string, nullable — The last name of the user.
  - `phone` string, nullable — The phone number of the user.
  - `job` string, nullable — The role title of the user.
  - `organization` string, nullable — The organization that the user belongs to.
  - `custom` string, nullable — The value of the **Additional information** field in the user’s profile. This is not the value of the custom fields associated with the user.
  - `lang` 'bg' | 'cs' | 'da' | 'de' | 'el' | 'en' | 'es' | 'fi' | 'fr' | 'hr' | 'ht_HT' | 'hu' | 'id' | 'it' | 'ja' | 'kar_MM' | 'ko' | 'lt' | 'mh_MH' | 'nl' | 'nl_BE' | 'no' | 'pl' | 'pt' | 'ro' | 'ru' | 'rw_RW' | 'sk' | 'sl' | 'so_SO' | 'sv' | 'sw_KE' | 'th' | 'ti_ET' | 'tr' | 'uk' | 'zh' | 'vi' — The default language of the user, in a bigram format (en, fr, de, etc.).
  - `toBeDeactivatedAt` string, date-time, nullable — The date and time when the user will be deactivated, in the `YYYY-MM-DDThh:mm:ss.sssZ` format (ISO 8601 in Coordinated Universal Time (UTC)). Note that this parameter cannot be set on a user that is already deactivated.
  - `mail` string, nullable — The email address of the user. Must not correspond to an existing user in the company.
  - `primaryGroupId` string, ObjectId, nullable — The unique ID of the primary group of the user.
  - `username` string, nullable — The username that can be used to log in if the company allows it. Options are: lowercase letters, numbers, and the following special characters: _ - . + # ! $ % & ' * / = ? ^ ` { | } ~.
  - `profileImageId` string, ObjectId, nullable — The unique ID of the media to use as the user's profile image. Set to null to remove the current image. Recommended size: 256px × 256px.

## Response `200`

Returns the updated user.

- UserDTO
  - `_id` string, ObjectId, required — The unique ID of the user.
  - `mail` string — The email address of the user.
  - `username` string — The username that can be used to log in if the company allows it.
  - `status` 'active' | 'invited' | 'deleted', required — The status of the user.
  - `lang` 'bg' | 'cs' | 'da' | 'de' | 'el' | 'en' | 'es' | 'fi' | 'fr' | 'hr' | 'ht_HT' | 'hu' | 'id' | 'it' | 'ja' | 'kar_MM' | 'ko' | 'lt' | 'mh_MH' | 'nl' | 'nl_BE' | 'no' | 'pl' | 'pt' | 'ro' | 'ru' | 'rw_RW' | 'sk' | 'sl' | 'so_SO' | 'sv' | 'sw_KE' | 'th' | 'ti_ET' | 'tr' | 'uk' | 'zh' | 'vi', required — The default language of the user, in a bigram format (en, fr, de, etc.).
  - `firstName` string — The first name of the user.
  - `lastName` string — The last name of the user.
  - `job` string — The role title of the user.
  - `organization` string — The organization that the user belongs to.
  - `phone` string — The phone number of the user.
  - `custom` string — The value of the **Additional information** field in the user’s profile. This is not the value of the custom fields associated with the user.
  - `deletedAt` string[] — The list of dates and times when the user’s profile was soft deleted, in the `YYYY-MM-DDThh:mm:ss.sssZ` format (ISO 8601 in Coordinated Universal Time (UTC)).
  - `primaryGroupId` string, ObjectId — The unique ID of the primary group of the user.
  - `reactivatedAt` string[] — The list of dates and times when the user’s profile was reactivated, in the `YYYY-MM-DDThh:mm:ss.sssZ` format (ISO 8601 in Coordinated Universal Time (UTC)).
  - `lastLoginDate` string, date-time — The date and time when the user last logged in, in the `YYYY-MM-DDThh:mm:ss.sssZ` format (ISO 8601 in Coordinated Universal Time (UTC)).
  - `toBeDeactivatedAt` string, date-time — The date and time when the user will be deactivated, in the `YYYY-MM-DDThh:mm:ss.sssZ` format (ISO 8601 in Coordinated Universal Time (UTC)).
  - `profileImageId` string, ObjectId — The unique ID of the profile image of the user.

## Other responses

- `400` — The server cannot or will not process the request due to something that is perceived to be a client error.
- `401` — The given access token is either missing, invalid, has expired, or has been revoked.
- `403` — The given access token does not have the required OAuth scope to execute the request.
- `404` — The given `userId` does not correspond to any existing user.
- `429` — The client has sent too many requests in a short amount of time.

---

[API](https://skmtc.net/360learning/apis/core-api.md) · [All operations](https://skmtc.net/360learning/apis/core-api/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/360learning/core-api/versions/94b691b0b72c/schema)