---
title: "Update User"
method: PATCH
path: "/users/{id}"
tags: ["users", "Users"]
---

# Update User

`PATCH /users/{id}`

Update User

## Path parameters

- `id` integer, required

## Response `200`

The Users object.

- UserEntity — UserEntity model
  - `id` integer — User ID
  - `username` string — User's username
  - `admin_group_ids` integer[] — List of group IDs of which this user is an administrator
  - `allowed_ips` string — A list of allowed IPs if applicable. Newline delimited
  - `attachments_permission` boolean — If `true`, the user can user create Bundles (aka Share Links). Use the bundle permission instead.
  - `api_keys_count` integer — Number of API keys associated with this user
  - `authenticate_until` string, date-time — Scheduled Date/Time at which user will be deactivated
  - `authentication_method` 'password' | 'sso' | 'none' | 'email_signup' | 'password_with_imported_hash' | 'password_and_ssh_key' — How is this user authenticated?
  - `avatar_url` string — URL holding the user's avatar
  - `billable` boolean — Is this a billable user record?
  - `billing_permission` boolean — Allow this user to perform operations on the account, payments, and invoices?
  - `bypass_site_allowed_ips` boolean — Allow this user to skip site-wide IP blacklists?
  - `bypass_user_lifecycle_rules` boolean — Exempt this user from user lifecycle rules?
  - `created_at` string, date-time — When this user was created
  - `dav_permission` boolean — Can the user connect with WebDAV?
  - `disabled` boolean — Is user disabled? Disabled users cannot log in, and do not count for billing purposes. Users can be automatically disabled after an inactivity period via a Site setting or schedule to be deactivated after specific date.
  - `disabled_expired_or_inactive` boolean — Computed property that returns true if user disabled or expired or inactive.
  - `ai_assistant_personality_id` integer — AI Assistant Personality ID assigned directly to this user, if any.
  - `desktop_configuration_profile_id` integer — Desktop Configuration Profile ID assigned directly to this user, if any.
  - `integration_centric_profile_id` integer — Integration Centric Profile ID assigned directly to this user, if any.
  - `email` string, email — User email address
  - `filesystem_layout` 'site_root' | 'user_root' | 'partner_root' | 'integration_centric' | 'workspace_root' — File system layout
  - `first_login_at` string, date-time — User's first login time
  - `ftp_permission` boolean — Can the user access with FTP/FTPS?
  - `group_ids` string — Comma-separated list of group IDs of which this user is a member
  - `header_text` string — Text to display to the user in the header of the UI
  - `language` string — Preferred language
  - `last_login_at` string, date-time — User's most recent login time via any protocol
  - `last_web_login_at` string, date-time — User's most recent login time via web
  - `last_ftp_login_at` string, date-time — User's most recent login time via FTP
  - `last_sftp_login_at` string, date-time — User's most recent login time via SFTP
  - `last_dav_login_at` string, date-time — User's most recent login time via WebDAV
  - `last_desktop_login_at` string, date-time — User's most recent login time via Desktop app
  - `last_restapi_login_at` string, date-time — User's most recent login time via Rest API
  - `last_api_use_at` string, date-time — User's most recent API use time
  - `last_active_at` string, date-time — User's most recent activity time, which is the latest of most recent login, most recent API use, enablement, or creation
  - `last_protocol_cipher` string — The most recent protocol and cipher used
  - `lockout_expires` string, date-time — Time in the future that the user will no longer be locked out if applicable
  - `name` string — User's full name
  - `company` string — User's company
  - `notes` string — Any internal notes on the user
  - `notification_daily_send_time` integer — Hour of the day at which daily notifications should be sent. Can be in range 0 to 23
  - `office_integration_enabled` boolean — Enable integration with Office for the web?
  - `partner_admin` boolean — Is this user a Partner administrator?
  - `partner_id` integer — Partner ID if this user belongs to a Partner
  - `partner_name` string — Name of the Partner if this user belongs to a Partner
  - `password_set_at` string, date-time — Last time the user's password was set
  - `password_validity_days` integer — Number of days to allow user to use the same password
  - `primary_group_id` integer — Primary group ID for Group Admin scoping
  - `public_keys_count` integer — Number of public keys associated with this user
  - `receive_admin_alerts` boolean — Deprecated. Use notify_on_all_site_warnings and granular failure notification preferences instead.
  - `notify_on_all_site_warnings` boolean — Should the user receive site warnings via email?
  - `notify_on_all_sso_failures` boolean — Should the user receive sso/scim/ldap configuration/sync failures via email?
  - `notify_on_all_user_security_events` boolean — Should the user receive user security events via email?
  - `notify_on_all_pending_work_failures` boolean — Should the user receive pending work failures via email?
  - `notify_on_all_siem_http_destination_failures` boolean — Should the user receive siem failures via email?
  - `notify_on_all_sync_failures` boolean — Should the user receive sync failures via email?
  - `notify_on_all_automation_failures` boolean — Should the user receive automation failures via email?
  - `notify_on_all_expectation_failures` boolean — Should the user receive expectation failures and misses via email?
  - `require_2fa` 'use_system_setting' | 'always_require' | 'never_require' — 2FA required setting. `use_system_setting` uses the site-wide setting, including SSO exemptions. `always_require` and `never_require` override the site-wide setting when user-level overrides are allowed.
  - `require_login_by` string, date-time — Require user to login by specified date otherwise it will be disabled.
  - `active_2fa` boolean — Is 2fa active for the user?
  - `require_password_change` boolean — Is a password change required upon next user login?
  - `password_expired` boolean — Is user's password expired?
  - `responsible_group_id` integer — ID of the internal Group responsible for this Partner User, overriding the Partner default.
  - `responsible_user_id` integer — ID of the internal User responsible for this Partner User, overriding the Partner default.
  - `readonly_site_admin` boolean — Is the user an allowed to view all (non-billing) site configuration for this site?
  - `restapi_permission` boolean — Can this user access the Web app, Desktop app, SDKs, or REST API? (All of these tools use the API internally, so this is one unified permission set.)
  - `self_managed` boolean — Does this user manage it's own credentials or is it a shared/bot user?
  - `sftp_permission` boolean — Can the user access with SFTP?
  - `site_admin` boolean — Is the user an administrator for this site?
  - `workspace_admin` boolean — Is the user a Workspace administrator? Applicable only to the workspace ID related to this user, if one is set.
  - `site_id` integer — Site ID
  - `workspace_id` integer — Workspace ID
  - `default_workspace_id` integer — Workspace ID the user should land in by default when more than one Workspace is available.
  - `skip_welcome_screen` boolean — Skip Welcome page in the UI?
  - `ssl_required` 'use_system_setting' | 'always_require' | 'never_require' — SSL required setting
  - `sso_strategy_id` integer — SSO (Single Sign On) strategy ID for the user, if applicable.
  - `subscribe_to_newsletter` boolean — Is the user subscribed to the newsletter?
  - `externally_managed` boolean — Is this user managed by a SsoStrategy?
  - `tags` string — Comma-separated list of Tags for this user. Tags are used for other features, such as UserLifecycleRules, which can target specific tags. Tags must only contain lowercase letters, numbers, and hyphens.
  - `time_zone` string — User time zone
  - `type_of_2fa` string — Type(s) of 2FA methods in use, for programmatic use. Will be either `sms`, `totp`, `webauthn`, `yubi`, `email`, or multiple values sorted alphabetically and joined by an underscore. Does not specify whether user has more than one of a given method.
  - `type_of_2fa_for_display` string — Type(s) of 2FA methods in use, formatted for displaying in the UI. Unlike `type_of_2fa`, this value will make clear when a user has more than 1 of the same type of method.
  - `user_root` string — If filesystem layout is user_root, this path is the root path the user is fixed to for all interfaces. If the filesystem layout is site_root or partner_root, this acts as a root folder only for FTP and SFTP (SFTP applicability also requires a site-wide setting to be set). For partner_root layout, this path is relative to the Partner root folder for all callers and blank opts out of an additional protocol root. In this situation, this path is not applied to the API, Desktop, or Web interface.
  - `user_home` string — Home folder for FTP/SFTP. For users with the partner_root filesystem layout, this path is relative to the Partner root folder. In all other cases, it is an absolute path. Only applies to FTP and SFTP, and not any other interface.
  - `days_remaining_until_password_expire` integer — Number of days remaining until password expires
  - `password_expire_at` string, date-time — Password expiration datetime

## Other responses

- `400` — Bad Request
- `401` — Unauthorized
- `403` — Forbidden
- `404` — Not Found
- `405` — Method Not Allowed
- `409` — Conflict
- `412` — Precondition Failed
- `422` — Unprocessable Entity
- `423` — Locked
- `429` — Too Many Requests

---

[API](https://skmtc.net/files/apis/files-com-api.md) · [All operations](https://skmtc.net/files/apis/files-com-api/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/files/files-com-api/versions/c80c746637fd/schema)