---
title: "Promote a user to system administrator"
method: POST
path: "/system/admin/promote"
tags: ["System Admin"]
---

# Promote a user to system administrator

`POST /system/admin/promote`

Grant system administrator privileges to a user (SystemAdmin only).
Idempotent: re-promoting an existing system admin returns 200 with no DB write.
Identify the user by email (preferred for human operators) or user_id (UUID, for API clients).

## Request body

- InternalHandlerPromoteUserToSystemAdminRequest
  - `email` string
  - `user_id` string

## Response `200`

User promoted successfully

- GithubComTencentWeKnoraInternalTypesUserInfo
  - `avatar` string
  - `can_access_all_tenants` boolean
  - `created_at` string
  - `email` string
  - `id` string
  - `is_active` boolean
  - `is_system_admin` boolean
  - `preferences` GithubComTencentWeKnoraInternalTypesUserPreferences
    - `last_active_tenant_id` integer — LastActiveTenantID remembers the last workspace the user actively switched into, so a fresh login (new device, cleared browser, new refresh token) lands them back in that workspace instead of always bouncing to their home workspace. Login / RefreshToken validate that the workspace still exists and the user still has an active membership (or CanAccessAllTenants) before honouring this preference; an invalid pointer is best-effort cleared and the user falls back to home. nil = no preference (use user.TenantID, i.e. home) *0 = "clear preference" sentinel for the partial-update endpoint (UpdateUserPreferences turns this into nil). Otherwise treat a stored *0 the same as nil. *N = preferred workspace id.
    - `oidc_only_login` boolean — OidcOnlyLogin is set server-side when an account is auto-provisioned via OIDC with a random password the user never received. The profile UI hides self-service password rotation until the user sets a known password via ChangePassword (which clears this flag).
  - `tenant_id` integer
  - `updated_at` string
  - `username` string

## Other responses

- `400` — Bad request
- `403` — Forbidden: not a system admin
- `404` — User not found

---

[API](https://skmtc.net/tencentblueking/apis/weknora-api.md) · [All operations](https://skmtc.net/tencentblueking/apis/weknora-api/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/tencentblueking/weknora-api/revisions/abce9036def5/schema)