v2

latestOpenAPI 3.1.02026-08-05267431678.1 KB

teams

Update Member Role

Update a team member's role.

Requires owner or admin role. Passing role=owner performs an ownership transfer to an existing member; ordinary role updates cannot directly modify the current owner.

Accepted risk (ENG-1281): AAL2 enforcement was intentionally removed (PR #3928) — users without MFA enrolled were being blocked from routine team operations. Promoting a low-privilege collaborator is part of the L-A16 escalation chain: an AAL1 attacker on a team-admin's session could promote a colluding member into MANAGE_BILLING and pivot into credential minting. This risk is accepted per the design decision.

patch/teams/{team_id}/members/{user_id}

Path parameters

team_idstring required

user_idstring required

Request body

role'owner' | 'billing' | 'admin' | 'editor' | 'viewer' required

Team member roles with hierarchical permissions.

Wire DTO mirror of the ORM TeamRoleType enum. Used only for API request/response serialization; authorization decisions route through the ORM matrix (database_tables.permissions), never this enum.

Response

Successful Response

idstring required

team_idstring required

user_idstring required

role'owner' | 'billing' | 'admin' | 'editor' | 'viewer' required

Team member roles with hierarchical permissions.

Wire DTO mirror of the ORM TeamRoleType enum. Used only for API request/response serialization; authorization decisions route through the ORM matrix (database_tables.permissions), never this enum.

joined_atstring required

user_emailstring nullable

user_namestring nullable

user_avatar_urlstring nullable

mfa_enabledboolean nullable

mfa_factor_countinteger nullable