Skip to main content
PATCH
Changes the role of one member of your organisation. The change takes effect on their next request. This endpoint takes a signed-in console session, not an API key. Send the session cookies your browser received when you signed in, plus the X-CSRF-Token header set to the value of the csrf_token cookie. A request authenticated with an mithunai_sk_ key is refused with 403. You need the owner or admin role. Four rules apply, whoever you are:
  • You cannot change your own role. Ask another administrator. Returns 403.
  • The owner’s role cannot be changed, and nobody can be changed to owner: an organisation has exactly one owner. Changing the owner’s seat returns 409; asking for owner returns 400.
  • You cannot change someone more senior than you. Returns 403.
  • You cannot give a role above your own. Returns 403.
Lowering a role also withdraws what that person could no longer hand out: API keys they created, and invitations they sent, for roles above their new one stop working. Raising a role withdraws nothing. A member who does not exist, a member of another organisation and a malformed ID all return the same 404. See Members.
string
required
The member’s account ID (UUID), as returned in account_id by List members.
string
required
The value of your session’s csrf_token cookie (named __Host-csrf_token when the console is served over HTTPS without a shared cookie domain). A missing or mismatched token returns 401.
string
required
The role to change them to: admin, editor, normal or dataset_operator. normal is the member role. See Organisations and roles.

Response

Returns 200 with the member as they now are.
string
required
The member’s account ID (UUID).
string
required
The account’s email address.
string
required
The account’s display name.
string
required
The role they now hold.
string
required
The membership status: active, pending or suspended.
Last modified on November 7, 2026