---
title: "Update a user by ID"
method: PATCH
path: "/users/{id}"
tags: ["User Management"]
---

# Update a user by ID

`PATCH /users/{id}`

Updates a subset of user-level attributes.

Other sub-resources (e.g. emails, credentials) are managed via dedicated endpoints and are not updated via this endpoint.

## Path parameters

- `id` string, uuid4, required

## Request body

- object — Patch payload for updating a user. Omitted properties are not changed.
  - `username` string, nullable — Set a new username for the user. Send `null` to remove the username.
  - `name` string, nullable — Set a new username for the user. Send `null` to remove the name.
  - `given_name` string, nullable — Set a new given name for the user. Send `null` to remove the given_name.
  - `family_name` string, nullable — Set a new family name for the user. Send `null` to remove the family_name.
  - `picture` string, uri, nullable — Set a new picture for the user. Must be a public URL accessible via HTTP/HTTPS. Must not contain credentials. Send `null` to remove the picture.

## Response `200`

Details about the user

- User
  - `id` string, uuid4
  - `user_id` string, uuid4
  - `emails` object[]
    - `id` string, uuid4
    - `address` string, email — The email address
    - `is_verified` boolean — Indicated the email has been verified.
    - `is_primary` boolean — Indicates it's the primary email address.
    - `identity` object — Deprecated, use `user.identities` instead.
      - `id` string — The ID of the user at the provider
      - `identity_id` string, uuid4 — The identity's ID
      - `provider` string — Contains the display name of the provider, if available. Otherwise contains the provider ID.
    - `identities` Identity[] — Deprecated, use `user.identities` instead.
      - `id` string — The ID of the user at the provider
      - `identity_id` string, uuid4 — The identity's ID
      - `provider` string — Contains the display name of the provider, if available. Otherwise contains the provider ID.
  - `created_at` string, date-time — Time of creation of the the user
  - `updated_at` string, date-time — Time of last update of the user
  - `passkeys` WebauthnCredential[]
    - `aaguid` string, uuid
    - `attestation_type` 'none' | 'packed' | 'tpm' | 'android-key' | 'android-safetynet' | 'fido-u2f' | 'apple'
    - `backup_eligible` boolean
    - `backup_state` boolean
    - `created_at` string, date-time
    - `id` string, uuid
    - `last_used_at` string, date-time
    - `mfa_only` boolean
    - `name` string
    - `public-key` string
    - `transports` string[]
  - `security_keys` WebauthnCredential[]
    - `aaguid` string, uuid
    - `attestation_type` 'none' | 'packed' | 'tpm' | 'android-key' | 'android-safetynet' | 'fido-u2f' | 'apple'
    - `backup_eligible` boolean
    - `backup_state` boolean
    - `created_at` string, date-time
    - `id` string, uuid
    - `last_used_at` string, date-time
    - `mfa_only` boolean
    - `name` string
    - `public-key` string
    - `transports` string[]
  - `metadata` UserMetadata — The public and unsafe metadata of a user
    - `public_metadata` object
    - `unsafe_metadata` object
  - `name` string
  - `given_name` string
  - `family_name` string
  - `picture` string, uri
  - `mfa_config` object
    - `auth_app_set_up` boolean
    - `totp_enabled` boolean
    - `security_key_enabled` boolean
  - `otp` OTP
    - `id` string, uuid, required
    - `created_at` string, date-time, required
  - `password` string — The actual password, its `minLength` defaults to 8 but can be [configured](https://github.com/teamhanko/hanko/blob/main/backend/docs/Config.md#hanko-backend-config) through the `password.min_password_length` option.
  - `identities` Identity[] — The user's third party connections/identities.
    - `id` string — The ID of the user at the provider
    - `identity_id` string, uuid4 — The identity's ID
    - `provider` string — Contains the display name of the provider, if available. Otherwise contains the provider ID.

## Other responses

- `400` — Bad Request
- `404` — Not Found
- `500` — Internal server error

---

[API](https://skmtc.net/hanko/apis/hanko-admin-api.md) · [All operations](https://skmtc.net/hanko/apis/hanko-admin-api/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/hanko/hanko-admin-api/versions/d22a127b0978/schema)