---
title: "Transfer Ownership"
method: POST
path: "/teams/{team_id}/transfer-ownership/{new_owner_id}"
tags: ["teams"]
---

# Transfer Ownership

`POST /teams/{team_id}/transfer-ownership/{new_owner_id}`

Transfer team ownership to another member.

Only the current owner can transfer ownership. The current owner becomes
an admin after transfer.

**Accepted risk (ENG-1281):** AAL2 enforcement was intentionally removed
(PR #3928) — users without MFA enrolled were being blocked from routine
team operations. Ownership transfer is the highest-impact admin action;
an AAL1 attacker on the owner's session could hand the team to a
colluding member and pivot into credential / billing surfaces. This risk
is accepted per the design decision.

Path params are typed as :class:`uuid.UUID` so FastAPI rejects malformed
inputs with a clean 422 at the API boundary instead of letting them
leak into the service and trip an asyncpg
``invalid input syntax for type uuid`` 500 via the role lookup
(ENG-2214 / Sentry PYTHON-1SY0).

## Path parameters

- `team_id` string, uuid, required
- `new_owner_id` string, uuid, required

## Response `200`

Successful Response

- object

## Other responses

- `422` — Validation Error

---

[API](https://skmtc.net/pioneer/apis/brain-api.md) · [All operations](https://skmtc.net/pioneer/apis/brain-api/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/pioneer/brain-api/revisions/31dfe831e079/schema)