---
title: "Update user group"
method: PUT
path: "/v1/user-groups/{group-id}"
tags: ["User Groups"]
---

# Update user group

`PUT /v1/user-groups/{group-id}`

Update an existing user group. Only the fields provided in the request body will be modified. Requires MANAGE_USERS access right.

## Path parameters

- `group-id` integer, required

## Request body

- UserGroupUpdateInput — User group update request. All fields are optional - only provided fields are modified.
  - `name` string — New group name
  - `description` string — Group description
  - `flags` UserFlags — User or group flags. When used in update requests, only the specified boolean fields are modified (PATCH semantics).
    - `disabled` boolean — Whether the account is disabled
    - `changePassword` boolean — Must change password at next login
    - `cannotChangePassword` boolean — Cannot change own password
    - `intruderLockout` boolean — Account locked out due to repeated authentication failures
    - `passwordNeverExpires` boolean — Password never expires
    - `ldapUser` boolean — Synchronized from LDAP
    - `syncException` boolean — Excluded from LDAP synchronization
    - `closeOtherSessions` boolean — Close other sessions on login
    - `tokenAuthOnly` boolean — Can only authenticate using API tokens
    - `twoFAExempt` boolean — Exempt from two-factor authentication
    - `twoFAEnforce` boolean — Two-factor authentication is enforced
    - `serviceAccount` boolean — Service account (can only authenticate via API tokens, interactive login rejected)
  - `systemRights` integer — System access rights bitmask
  - `uiAccessRules` string — UI access rules
  - `attributes` object — Custom attributes (replaces all existing attributes)
  - `members` integer[] — List of member user IDs (replaces current members)

## Response `200`

User group updated successfully

- UserGroup — User group
  - `id` integer — Group ID (includes GROUP_FLAG bit 0x40000000)
  - `guid` string, uuid — Group GUID
  - `name` string — Group name
  - `description` string — Group description
  - `systemRights` integer — System access rights bitmask
  - `uiAccessRules` string — UI access rules
  - `flags` UserFlags — User or group flags. When used in update requests, only the specified boolean fields are modified (PATCH semantics).
    - `disabled` boolean — Whether the account is disabled
    - `changePassword` boolean — Must change password at next login
    - `cannotChangePassword` boolean — Cannot change own password
    - `intruderLockout` boolean — Account locked out due to repeated authentication failures
    - `passwordNeverExpires` boolean — Password never expires
    - `ldapUser` boolean — Synchronized from LDAP
    - `syncException` boolean — Excluded from LDAP synchronization
    - `closeOtherSessions` boolean — Close other sessions on login
    - `tokenAuthOnly` boolean — Can only authenticate using API tokens
    - `twoFAExempt` boolean — Exempt from two-factor authentication
    - `twoFAEnforce` boolean — Two-factor authentication is enforced
    - `serviceAccount` boolean — Service account (can only authenticate via API tokens, interactive login rejected)
  - `attributes` object — Custom attributes
  - `ldapDn` string, nullable — LDAP distinguished name
  - `ldapId` string, nullable — LDAP unique ID
  - `created` integer — Group creation time (Unix timestamp)
  - `members` integer[] — List of member user IDs

## Other responses

- `400` — Invalid group ID or invalid group name
- `401` — Unauthorized
- `403` — User does not have MANAGE_USERS access right
- `404` — User group not found
- `409` — Group with this name already exists
- `500` — Database failure

---

[API](https://skmtc.net/netxms/apis/netxms-api.md) · [All operations](https://skmtc.net/netxms/apis/netxms-api/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/netxms/netxms-api/versions/ee1f54ee3abd/schema)