---
title: "Modify system roles for a specific user"
method: PATCH
path: "/api/v1alpha/system_roles/{user_id}"
tags: ["System Roles"]
---

# Modify system roles for a specific user

`PATCH /api/v1alpha/system_roles/{user_id}`

Add or remove a system role for a specific user. The request body must contain exactly one of 'role_addition' or 'role_removal' fields, but not both.

## Path parameters

- `user_id` union, required
  - integer — User ID
  - string — Username

## Request body

- union
  - object
    - `role_addition` 'developer' | 'billing_manager' | 'sysadmin' | 'sysadmin-readonly', required — System role to add to the user
  - object
    - `role_removal` 'developer' | 'billing_manager' | 'sysadmin' | 'sysadmin-readonly', required — System role to remove from the user

## Response `200`

System role successfully modified

- object
  - `action` 'added' | 'removed' — The action that was performed
  - `role` 'developer' | 'billing_manager' — The role that was modified
  - `user` string — Username of the affected user

## Other responses

- `400` — Bad request - invalid role name, missing required fields, or both addition and removal fields present
- `401` — Unauthorized
- `403` — Forbidden - requires developer privileges
- `404` — User not found or not active
- `409` — Conflict - trying to add a role the user already has, or remove a role they don't have

---

[API](https://skmtc.net/hail-is/apis/hail-auth-service.md) · [All operations](https://skmtc.net/hail-is/apis/hail-auth-service/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/hail-is/hail-auth-service/revisions/ec7e68cd907c/schema)