Change a member's role
Move a member of your organisation to a different role. Takes a console session, never an API key. The owner’s role and your own cannot change.
PATCH
/
members
/
{account_id}
# cookies.txt holds the cookies from your signed-in console session.
curl --request PATCH "$MITHUNAI_URL/mithunai/api/v1/members/7c9e6679-7425-40de-944b-e07fc1f90ae7" \
--cookie cookies.txt \
--header "X-CSRF-Token: $MITHUNAI_CSRF_TOKEN" \
--header "Content-Type: application/json" \
--data '{"role": "admin"}'
import os
from http.cookiejar import MozillaCookieJar
import requests
jar = MozillaCookieJar("cookies.txt")
jar.load()
account_id = "7c9e6679-7425-40de-944b-e07fc1f90ae7"
response = requests.patch(
f"{os.environ['MITHUNAI_URL']}/mithunai/api/v1/members/{account_id}",
cookies=jar,
headers={"X-CSRF-Token": os.environ["MITHUNAI_CSRF_TOKEN"]},
json={"role": "admin"},
timeout=30,
)
response.raise_for_status()
print(response.json()["role"])
// Runs in a page on the MITHUNAI console's own origin, while signed in.
// csrfToken is the value of the csrf_token cookie.
const accountId = '7c9e6679-7425-40de-944b-e07fc1f90ae7'
const response = await fetch(`/mithunai/api/v1/members/${accountId}`, {
method: 'PATCH',
credentials: 'include',
headers: { 'Content-Type': 'application/json', 'X-CSRF-Token': csrfToken },
body: JSON.stringify({ role: 'admin' }),
})
console.log((await response.json()).role)
{
"account_id": "7c9e6679-7425-40de-944b-e07fc1f90ae7",
"email": "sarah.chen@example.com",
"name": "Sarah Chen",
"role": "admin",
"status": "active"
}
{ "code": "authorization_error", "message": "You cannot change or remove your own seat." }
{ "code": "not_found", "message": "The requested resource was not found." }
{
"code": "conflict",
"message": "The organisation's owner cannot be changed or removed. Transfer ownership first."
}
Changes the role of one member of your organisation. The change takes effect on their next request.
This endpoint takes a signed-in console session, not an API key. Send the session cookies your browser received when you signed in, plus the
X-CSRF-Token header set to the value of the csrf_token cookie. A request authenticated with an mithunai_sk_ key is refused with 403.
You need the owner or admin role. Four rules apply, whoever you are:
- You cannot change your own role. Ask another administrator. Returns
403. - The owner’s role cannot be changed, and nobody can be changed to
owner: an organisation has exactly one owner. Changing the owner’s seat returns409; asking forownerreturns400. - You cannot change someone more senior than you. Returns
403. - You cannot give a role above your own. Returns
403.
404. See Members.
string
required
The member’s account ID (UUID), as returned in
account_id by List
members.string
required
The value of your session’s
csrf_token cookie (named __Host-csrf_token when the console is
served over HTTPS without a shared cookie domain). A missing or mismatched token returns 401.string
required
The role to change them to:
admin, editor, normal or dataset_operator. normal is the
member role. See Organisations and roles.Response
Returns200 with the member as they now are.
string
required
The member’s account ID (UUID).
string
required
The account’s email address.
string
required
The account’s display name.
string
required
The role they now hold.
string
required
The membership status:
active, pending or suspended.# cookies.txt holds the cookies from your signed-in console session.
curl --request PATCH "$MITHUNAI_URL/mithunai/api/v1/members/7c9e6679-7425-40de-944b-e07fc1f90ae7" \
--cookie cookies.txt \
--header "X-CSRF-Token: $MITHUNAI_CSRF_TOKEN" \
--header "Content-Type: application/json" \
--data '{"role": "admin"}'
import os
from http.cookiejar import MozillaCookieJar
import requests
jar = MozillaCookieJar("cookies.txt")
jar.load()
account_id = "7c9e6679-7425-40de-944b-e07fc1f90ae7"
response = requests.patch(
f"{os.environ['MITHUNAI_URL']}/mithunai/api/v1/members/{account_id}",
cookies=jar,
headers={"X-CSRF-Token": os.environ["MITHUNAI_CSRF_TOKEN"]},
json={"role": "admin"},
timeout=30,
)
response.raise_for_status()
print(response.json()["role"])
// Runs in a page on the MITHUNAI console's own origin, while signed in.
// csrfToken is the value of the csrf_token cookie.
const accountId = '7c9e6679-7425-40de-944b-e07fc1f90ae7'
const response = await fetch(`/mithunai/api/v1/members/${accountId}`, {
method: 'PATCH',
credentials: 'include',
headers: { 'Content-Type': 'application/json', 'X-CSRF-Token': csrfToken },
body: JSON.stringify({ role: 'admin' }),
})
console.log((await response.json()).role)
{
"account_id": "7c9e6679-7425-40de-944b-e07fc1f90ae7",
"email": "sarah.chen@example.com",
"name": "Sarah Chen",
"role": "admin",
"status": "active"
}
{ "code": "authorization_error", "message": "You cannot change or remove your own seat." }
{ "code": "not_found", "message": "The requested resource was not found." }
{
"code": "conflict",
"message": "The organisation's owner cannot be changed or removed. Transfer ownership first."
}
Last modified on November 7, 2026
# cookies.txt holds the cookies from your signed-in console session.
curl --request PATCH "$MITHUNAI_URL/mithunai/api/v1/members/7c9e6679-7425-40de-944b-e07fc1f90ae7" \
--cookie cookies.txt \
--header "X-CSRF-Token: $MITHUNAI_CSRF_TOKEN" \
--header "Content-Type: application/json" \
--data '{"role": "admin"}'
import os
from http.cookiejar import MozillaCookieJar
import requests
jar = MozillaCookieJar("cookies.txt")
jar.load()
account_id = "7c9e6679-7425-40de-944b-e07fc1f90ae7"
response = requests.patch(
f"{os.environ['MITHUNAI_URL']}/mithunai/api/v1/members/{account_id}",
cookies=jar,
headers={"X-CSRF-Token": os.environ["MITHUNAI_CSRF_TOKEN"]},
json={"role": "admin"},
timeout=30,
)
response.raise_for_status()
print(response.json()["role"])
// Runs in a page on the MITHUNAI console's own origin, while signed in.
// csrfToken is the value of the csrf_token cookie.
const accountId = '7c9e6679-7425-40de-944b-e07fc1f90ae7'
const response = await fetch(`/mithunai/api/v1/members/${accountId}`, {
method: 'PATCH',
credentials: 'include',
headers: { 'Content-Type': 'application/json', 'X-CSRF-Token': csrfToken },
body: JSON.stringify({ role: 'admin' }),
})
console.log((await response.json()).role)
{
"account_id": "7c9e6679-7425-40de-944b-e07fc1f90ae7",
"email": "sarah.chen@example.com",
"name": "Sarah Chen",
"role": "admin",
"status": "active"
}
{ "code": "authorization_error", "message": "You cannot change or remove your own seat." }
{ "code": "not_found", "message": "The requested resource was not found." }
{
"code": "conflict",
"message": "The organisation's owner cannot be changed or removed. Transfer ownership first."
}