---
title: "Modify user permission"
method: PATCH
path: "/v2/modify-user-permission"
tags: ["user"]
---

# Modify user permission

`PATCH /v2/modify-user-permission`

Use this endpoint to update a user's permissions by providing both user ID and team ID. To modify permissions for supplier teams, full supplier access is required, while full retailer access is necessary for retailer teams. 

Retailers can modify supplier permissions by specifying retailerTeamId. Ensure that API requests are authenticated with the retailer's bearer token. 

Users can be assigned either 'Retailer Full' and 'Retailer Report View' permissions or 'Supplier Full' and 'Supplier Report View' permissions. Combining retailer and supplier roles is not allowed.

## Request body

- V2ModifyUserPermissionRequest
  - `modifyUserPermission` Authv2ModifyUserPermission
    - `userId` string, required — The unique identifier of the user whose permissions you want to modify.
    - `teamId` string, required — The unique identifier of the team to which the user belongs.
    - `roles` V2ModifyUserPermissionRoleTypes[], required — A list of roles assigned to the user within the team. These roles determine the user's level of access and can include 'Retailer Full', 'Retailer Report View', 'Supplier Full', or 'Supplier Report View'. Users cannot mix retailer and supplier roles.
    - `retailerTeamId` string — The unique identifier for a retailer-managed team. As a retailer, you can modify supplier team permissions by specifying the retailerTeamId. Ensure that API requests are authenticated with the retailer's bearer token.

## Response `200`

Permission modified successfully.

- V2ModifyUserPermissionResponse
  - `modifyUserPermission` Authv2ModifyUserPermissionRes
    - `userId` string — The unique identifier of the user whose permissions you want to modify.
    - `teamId` string — The unique identifier of the team to which the user belongs.
    - `roles` V2ModifyUserPermissionRoleTypes[] — A list of roles assigned to the user within the team. These roles determine the user's level of access and can include 'Retailer Full', 'Retailer Report View', 'Supplier Full', or 'Supplier Report View'. Users cannot mix retailer and supplier roles.
    - `retailerTeamId` string — The unique identifier for a retailer-managed team. As a retailer, you can modify supplier team permissions by specifying the retailerTeamId. Ensure that API requests are authenticated with the retailer's bearer token.

## Other responses

- `400` — There was a problem with input.
- `401` — Login failed or token not valid.
- `403` — Login failed or token not valid.
- `404` — User for specified id does not exist.
- `default` — An unexpected error response.

---

[API](https://skmtc.net/citrusad/apis/citrus-auth-api.md) · [All operations](https://skmtc.net/citrusad/apis/citrus-auth-api/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/citrusad/citrus-auth-api/revisions/a040003c7378/schema)