---
title: "Update a Database User"
method: PUT
path: "/v2/databases/{database_cluster_uuid}/users/{username}"
tags: ["DigitalOcean-public.v2-new_Databases"]
---

# Update a Database User

`PUT /v2/databases/{database_cluster_uuid}/users/{username}`

To update an existing database user, send a PUT request to `/v2/databases/$DATABASE_ID/users/$USERNAME`
with the desired settings.

**Note**: only `settings` can be updated via this type of request. If you wish to change the name of a user,
you must recreate a new user.

The response will be a JSON object with a key called `user`. The value of this will be an
object that contains the name of the update database user, along with the `settings` object that
has been updated.

## Path parameters

- `database_cluster_uuid` string, uuid, required
- `username` string, required

## Request body

- object
  - `settings` UserSettings, required
    - `pg_allow_replication` boolean — For Postgres clusters, set to `true` for a user with replication rights. This option is not currently supported for other database engines.
    - `opensearch_acl` object[] — ACLs (Access Control Lists) specifying permissions on index within a OpenSearch cluster.
      - `index` string — A regex for matching the indexes that this ACL should apply to.
      - `permission` 'deny' | 'admin' | 'read' | 'readwrite' | 'write' — Permission set applied to the ACL. 'read' allows user to read from the index. 'write' allows for user to write to the index. 'readwrite' allows for both 'read' and 'write' permission. 'deny'(default) restricts user from performing any operation over an index. 'admin' allows for 'readwrite' as well as any operations to administer the index.
    - `acl` object[] — ACLs (Access Control Lists) specifying permissions on topics within a Kafka cluster.
      - `id` string — An identifier for the ACL. Will be computed after the ACL is created/updated.
      - `topic` string, required — A regex for matching the topic(s) that this ACL should apply to.
      - `permission` 'admin' | 'consume' | 'produce' | 'produceconsume', required — Permission set applied to the ACL. 'consume' allows for messages to be consumed from the topic. 'produce' allows for messages to be published to the topic. 'produceconsume' allows for both 'consume' and 'produce' permission. 'admin' allows for 'produceconsume' as well as any operations to administer the topic (delete, update).
    - `mongo_user_settings` object — MongoDB-specific settings for the user. This option is not currently supported for other database engines.
      - `databases` string[] — A list of databases to which the user should have access. When the database is set to `admin`, the user will have access to all databases based on the user's role i.e. a user with the role `readOnly` assigned to the `admin` database will have read access to all databases.
      - `role` 'readOnly' | 'readWrite' | 'dbAdmin' — The role to assign to the user with each role mapping to a MongoDB built-in role. `readOnly` maps to a [read](https://www.mongodb.com/docs/manual/reference/built-in-roles/#mongodb-authrole-read) role. `readWrite` maps to a [readWrite](https://www.mongodb.com/docs/manual/reference/built-in-roles/#mongodb-authrole-readWrite) role. `dbAdmin` maps to a [dbAdmin](https://www.mongodb.com/docs/manual/reference/built-in-roles/#mongodb-authrole-dbAdmin) role.

## Response `201`

A JSON object with a key of `user`.

- object
  - `user` DatabaseUser, required
    - `name` string, required — The name of a database user.
    - `role` 'primary' | 'normal' — A string representing the database user's role. The value will be either "primary" or "normal".
    - `password` string — A randomly generated password for the database user.<br>Requires `database:view_credentials` scope.
    - `access_cert` string — Access certificate for TLS client authentication. (Kafka only)
    - `access_key` string — Access key for TLS client authentication. (Kafka only)
    - `mysql_settings` MysqlSettings
      - `auth_plugin` 'mysql_native_password' | 'caching_sha2_password', required — A string specifying the authentication method to be used for connections to the MySQL user account. The valid values are `mysql_native_password` or `caching_sha2_password`. If excluded when creating a new user, the default for the version of MySQL in use will be used. As of MySQL 8.0, the default is `caching_sha2_password`.
    - `settings` UserSettings
      - `pg_allow_replication` boolean — For Postgres clusters, set to `true` for a user with replication rights. This option is not currently supported for other database engines.
      - `opensearch_acl` object[] — ACLs (Access Control Lists) specifying permissions on index within a OpenSearch cluster.
        - `index` string — A regex for matching the indexes that this ACL should apply to.
        - `permission` 'deny' | 'admin' | 'read' | 'readwrite' | 'write' — Permission set applied to the ACL. 'read' allows user to read from the index. 'write' allows for user to write to the index. 'readwrite' allows for both 'read' and 'write' permission. 'deny'(default) restricts user from performing any operation over an index. 'admin' allows for 'readwrite' as well as any operations to administer the index.
      - `acl` object[] — ACLs (Access Control Lists) specifying permissions on topics within a Kafka cluster.
        - `id` string — An identifier for the ACL. Will be computed after the ACL is created/updated.
        - `topic` string, required — A regex for matching the topic(s) that this ACL should apply to.
        - `permission` 'admin' | 'consume' | 'produce' | 'produceconsume', required — Permission set applied to the ACL. 'consume' allows for messages to be consumed from the topic. 'produce' allows for messages to be published to the topic. 'produceconsume' allows for both 'consume' and 'produce' permission. 'admin' allows for 'produceconsume' as well as any operations to administer the topic (delete, update).
      - `mongo_user_settings` object — MongoDB-specific settings for the user. This option is not currently supported for other database engines.
        - `databases` string[] — A list of databases to which the user should have access. When the database is set to `admin`, the user will have access to all databases based on the user's role i.e. a user with the role `readOnly` assigned to the `admin` database will have read access to all databases.
        - `role` 'readOnly' | 'readWrite' | 'dbAdmin' — The role to assign to the user with each role mapping to a MongoDB built-in role. `readOnly` maps to a [read](https://www.mongodb.com/docs/manual/reference/built-in-roles/#mongodb-authrole-read) role. `readWrite` maps to a [readWrite](https://www.mongodb.com/docs/manual/reference/built-in-roles/#mongodb-authrole-readWrite) role. `dbAdmin` maps to a [dbAdmin](https://www.mongodb.com/docs/manual/reference/built-in-roles/#mongodb-authrole-dbAdmin) role.

## Other responses

- `401` — Authentication failed due to invalid credentials.
- `404` — The resource was not found.
- `429` — The API rate limit has been exceeded.
- `500` — There was a server error.
- `default` — There was an unexpected error.

---

[API](https://skmtc.net/digitalocean/apis/digitalocean-api.md) · [All operations](https://skmtc.net/digitalocean/apis/digitalocean-api/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/digitalocean/digitalocean-api/versions/cb3bf9b21459/schema)