---
title: "Update a team member's roles"
method: PATCH
path: "/teams/{key}/members/{userId}"
tags: ["Team Members"]
---

# Update a team member's roles

`PATCH /teams/{key}/members/{userId}`

Update an existing active team member. Team key can be ID or slug. Replaces role assignments. Cannot modify isOwner (use transfer endpoint instead).

## Path parameters

- `key` string, required
- `userId` string, required

## Request body

- object
  - `id` string, required — Team member ID to update
  - `roleIds` string[], required — Replace role assignments for this team member with the provided role IDs.
  - `isOwner` boolean — Whether this team member is an owner of the team
  - `access` object — Optional promoter access assignment. Omit to update only role assignments.
    - `promoterIds` string[], nullable, required — Null grants team-wide promoter access. A non-empty array restricts access to those promoters.

## Response `200`

OK

- object
  - `member` object, required — Active team member with base permissions. Permissions can be overridden per promoter or venue. Created when a user accepts an invitation or is directly added to a team.
    - `id` string, required — Unique identifier for the team member
    - `createdAt` string, date-time, required — Timestamp in ISO 8601 format when the member was created
    - `updatedAt` string, date-time, required — Timestamp in ISO 8601 format when the member was last updated
    - `teamId` string, required — Team this member belongs to
    - `userId` string, required — User ID of the team member
    - `user` object, required — Denormalized user details for quick access without additional queries.
      - `id` string, required — Unique identifier of the user
      - `email` string, email, required — Email address of the user
      - `firstName` string, required — First name of the user
      - `lastName` string, required — Last name of the user
      - `imageUrl` string — Profile image URL of the user
    - `permissions` string[] — Base permissions across the team. Can be overridden per promoter or venue. Undefined means no base permissions (permissions come from PermissionScope only).
    - `roleIds` string[] — Role IDs assigned to this team member. Effective permissions are derived from role nodes plus explicit permission nodes.
    - `isOwner` boolean, required — Whether this member is the owner of the team. Only one owner per team is allowed. Owner has full control and cannot be deleted.
    - `access` object — Promoter access summary. Omitted only for legacy/no-access records.
      - `promoterIds` string[], nullable, required — Null means team-wide promoter access. An array means access is restricted to those promoters.
    - `tenantId` string, required — Tenant ID for multi-tenant isolation

## Other responses

- `400` — 400
- `401` — 401
- `403` — 403
- `404` — 404
- `409` — 409
- `412` — 412
- `422` — 422
- `429` — 429
- `500` — 500
- `501` — 501
- `503` — 503

---

[API](https://skmtc.net/session/apis/session-services-api.md) · [All operations](https://skmtc.net/session/apis/session-services-api/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/session/session-services-api/versions/a1bb6f6c8a2e/schema)