--- title: "Update user" method: PUT path: "/users/{user_id}" tags: ["Users"] --- # Update user `PUT /users/{user_id}` Updates a managed or app user in an enterprise. This endpoint is only available to users and applications with the right admin permissions. ## Path parameters - `user_id` string, required ## Query parameters - `fields` string[] ## Request body - object - `enterprise` string, nullable — Set this to `null` to roll the user out of the enterprise and make them a free user. - `notify` boolean — Whether the user should receive an email when they are rolled out of an enterprise. - `name` string — The name of the user. - `login` string — The email address the user uses to log in Note: If the target user's email is not confirmed, then the primary login address cannot be changed. - `role` 'coadmin' | 'user' — The user’s enterprise role. - `language` string — The language of the user, formatted in modified version of the [ISO 639-1](https://developer.box.com/guides/api-calls/language-codes) format. - `is_sync_enabled` boolean — Whether the user can use Box Sync. - `job_title` string — The user’s job title. - `phone` string — The user’s phone number. - `address` string — The user’s address. - `tracking_codes` TrackingCode[] — Tracking codes allow an admin to generate reports from the admin console and assign an attribute to a specific group of users. This setting must be enabled for an enterprise before it can be used. - `type` 'tracking_code' — The value will always be `tracking_code`. - `name` string — The name of the tracking code, which must be preconfigured in the Admin Console. - `value` string — The value of the tracking code. - `can_see_managed_users` boolean — Whether the user can see other enterprise users in their contact list. - `timezone` string, timezone — The user's timezone. - `is_external_collab_restricted` boolean — Whether the user is allowed to collaborate with users outside their enterprise. - `is_exempt_from_device_limits` boolean — Whether to exempt the user from enterprise device limits. - `is_exempt_from_login_verification` boolean — Whether the user must use two-factor authentication. - `is_password_reset_required` boolean — Whether the user is required to reset their password. - `status` 'active' | 'inactive' | 'cannot_delete_edit' | 'cannot_delete_edit_upload' — The user's account status. - `space_amount` integer — The user’s total available space in bytes. Set this to `-1` to indicate unlimited storage. - `notification_email` object, nullable — An alternate notification email address to which email notifications are sent. When it's confirmed, this will be the email address to which notifications are sent instead of to the primary email address. Set this value to `null` to remove the notification email. - `email` string — The email address to send the notifications to. - `external_app_user_id` string — An external identifier for an app user, which can be used to look up the user. This can be used to tie user IDs from external identity providers to Box users. Note: In order to update this field, you need to request a token using the application that created the app user. ## Response `200` Returns the updated user object. - UserFull — A mini representation of a user, used when nested within another resource. - `id` string, required — The unique identifier for this user. - `type` 'user', required — The value will always be `user`. - `name` string — The display name of this user. - `login` string, email — The primary email address of this user. - `created_at` string, date-time — When the user object was created. - `modified_at` string, date-time — When the user object was last modified. - `language` string — The language of the user, formatted in modified version of the [ISO 639-1](https://developer.box.com/guides/api-calls/language-codes) format. - `timezone` string, timezone — The user's timezone. - `space_amount` integer — The user’s total available space amount in bytes. - `space_used` integer — The amount of space in use by the user. - `max_upload_size` integer — The maximum individual file size in bytes the user can have. - `status` 'active' | 'inactive' | 'cannot_delete_edit' | 'cannot_delete_edit_upload' — The user's account status. - `job_title` string — The user’s job title. - `phone` string — The user’s phone number. - `address` string — The user’s address. - `avatar_url` string — URL of the user’s avatar image. - `notification_email` object, nullable — An alternate notification email address to which email notifications are sent. When it's confirmed, this will be the email address to which notifications are sent instead of to the primary email address. - `email` string — The email address to send the notifications to. - `is_confirmed` boolean — Specifies if this email address has been confirmed. - `role` 'admin' | 'coadmin' | 'user' — The user’s enterprise role. - `tracking_codes` TrackingCode[] — Tracking codes allow an admin to generate reports from the admin console and assign an attribute to a specific group of users. This setting must be enabled for an enterprise before it can be used. - `type` 'tracking_code' — The value will always be `tracking_code`. - `name` string — The name of the tracking code, which must be preconfigured in the Admin Console. - `value` string — The value of the tracking code. - `can_see_managed_users` boolean — Whether the user can see other enterprise users in their contact list. - `is_sync_enabled` boolean — Whether the user can use Box Sync. - `is_external_collab_restricted` boolean — Whether the user is allowed to collaborate with users outside their enterprise. - `is_exempt_from_device_limits` boolean — Whether to exempt the user from Enterprise device limits. - `is_exempt_from_login_verification` boolean — Whether the user must use two-factor authentication. - `enterprise` object — Representation of the user’s enterprise. - `id` string — The unique identifier for this enterprise. - `type` 'enterprise' — The value will always be `enterprise`. - `name` string — The name of the enterprise. - `my_tags` string[] — Tags for all files and folders owned by the user. Values returned will only contain tags that were set by the requester. - `hostname` string — The root (protocol, subdomain, domain) of any links that need to be generated for the user. - `is_platform_access_only` boolean — Whether the user is an App User. - `external_app_user_id` string — An external identifier for an app user, which can be used to look up the user. This can be used to tie user IDs from external identity providers to Box users. ## Other responses - `400` — Returns an error if some of the parameters are missing or not valid. * `invalid_parameter` when a parameter is formatted incorrectly, for example when the `notification_email` has an incorrectly formatted email address. - `403` — Returns an error if the user is not allowed to make the changes. * `access_denied_insufficient_permissions` when the user does not have the right permissions, for example when updating the notification email is turned off for the enterprise. * `denied_by_policy` when the user does not have the right permissions due to the information barrier restrictions. - `default` — An unexpected client error. --- [API](https://skmtc.net/box/apis/platform-api.md) · [All operations](https://skmtc.net/box/apis/platform-api/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/box/platform-api/revisions/ba8f087e1a4d/schema)