Update app user

curl --request PUT \
  --url https://app.base44.com/api/apps/{app_id}/entities/User/{user_id} \
  --header 'Authorization: Bearer <token>' \
  --header 'Content-Type: application/json' \
  --data '
{
  "role": "admin",
  "department": "Sales"
}
'

import requests

url = "https://app.base44.com/api/apps/{app_id}/entities/User/{user_id}"

payload = {
    "role": "admin",
    "department": "Sales"
}
headers = {
    "Authorization": "Bearer <token>",
    "Content-Type": "application/json"
}

response = requests.put(url, json=payload, headers=headers)

print(response.text)

const options = {
  method: 'PUT',
  headers: {Authorization: 'Bearer <token>', 'Content-Type': 'application/json'},
  body: JSON.stringify({role: 'admin', department: 'Sales'})
};

fetch('https://app.base44.com/api/apps/{app_id}/entities/User/{user_id}', options)
  .then(res => res.json())
  .then(res => console.log(res))
  .catch(err => console.error(err));

<?php

$curl = curl_init();

curl_setopt_array($curl, [
  CURLOPT_URL => "https://app.base44.com/api/apps/{app_id}/entities/User/{user_id}",
  CURLOPT_RETURNTRANSFER => true,
  CURLOPT_ENCODING => "",
  CURLOPT_MAXREDIRS => 10,
  CURLOPT_TIMEOUT => 30,
  CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
  CURLOPT_CUSTOMREQUEST => "PUT",
  CURLOPT_POSTFIELDS => json_encode([
    'role' => 'admin',
    'department' => 'Sales'
  ]),
  CURLOPT_HTTPHEADER => [
    "Authorization: Bearer <token>",
    "Content-Type: application/json"
  ],
]);

$response = curl_exec($curl);
$err = curl_error($curl);

curl_close($curl);

if ($err) {
  echo "cURL Error #:" . $err;
} else {
  echo $response;
}

package main

import (
	"fmt"
	"strings"
	"net/http"
	"io"
)

func main() {

	url := "https://app.base44.com/api/apps/{app_id}/entities/User/{user_id}"

	payload := strings.NewReader("{\n  \"role\": \"admin\",\n  \"department\": \"Sales\"\n}")

	req, _ := http.NewRequest("PUT", url, payload)

	req.Header.Add("Authorization", "Bearer <token>")
	req.Header.Add("Content-Type", "application/json")

	res, _ := http.DefaultClient.Do(req)

	defer res.Body.Close()
	body, _ := io.ReadAll(res.Body)

	fmt.Println(string(body))

}

HttpResponse<String> response = Unirest.put("https://app.base44.com/api/apps/{app_id}/entities/User/{user_id}")
  .header("Authorization", "Bearer <token>")
  .header("Content-Type", "application/json")
  .body("{\n  \"role\": \"admin\",\n  \"department\": \"Sales\"\n}")
  .asString();

require 'uri'
require 'net/http'

url = URI("https://app.base44.com/api/apps/{app_id}/entities/User/{user_id}")

http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true

request = Net::HTTP::Put.new(url)
request["Authorization"] = 'Bearer <token>'
request["Content-Type"] = 'application/json'
request.body = "{\n  \"role\": \"admin\",\n  \"department\": \"Sales\"\n}"

response = http.request(request)
puts response.read_body

{
  "id": "6874b0c2e1a94d0031bb77de",
  "email": "jane@acme.com",
  "full_name": "Jane Cooper",
  "role": "user",
  "collaborator_role": "editor",
  "created_date": "2026-06-01T09:23:41.481000Z",
  "updated_date": "2026-06-04T14:07:02.115000Z"
}

Users

Update app user

This API is in beta. Endpoints, fields, and behavior may still change, so avoid depending on it in production.

Changes a user’s role or the extra fields the app stores on them, and returns the updated user.

Send role to change the user’s role. It isn’t checked against the roles the app defines, so a misspelled role is saved as sent. If the user also belongs to a group shared with the app, they keep the highest role any of their groups gives them, so the role in the response can be higher than the one you sent. Only the app’s owner can change the owner’s role.

Every other field you send is merged into the user’s record. A field you leave out keeps its value. The fields aren’t checked against the User schema, so a misspelled name is stored under that name. email and full_name belong to the user’s account and are ignored, as are id and collaborator_role.

Field-level security rules on the User entity apply. A role you send is saved before the other fields are checked, so a call rejected for another field, by one of those rules or for an oversized value, changes none of the other fields but still changes the role.

Updating a user triggers the app’s webhooks for the User entity.

The response includes fields beyond the ones documented here. Don’t rely on undocumented response fields, as they can change at any time.

This endpoint accepts a personal API key belonging to a user with editor access to the app. A read-only key is refused, and workspace API keys are not accepted.

PUT

api

apps

{app_id}

entities

User

{user_id}

Update app user

curl --request PUT \
  --url https://app.base44.com/api/apps/{app_id}/entities/User/{user_id} \
  --header 'Authorization: Bearer <token>' \
  --header 'Content-Type: application/json' \
  --data '
{
  "role": "admin",
  "department": "Sales"
}
'

import requests

url = "https://app.base44.com/api/apps/{app_id}/entities/User/{user_id}"

payload = {
    "role": "admin",
    "department": "Sales"
}
headers = {
    "Authorization": "Bearer <token>",
    "Content-Type": "application/json"
}

response = requests.put(url, json=payload, headers=headers)

print(response.text)

const options = {
  method: 'PUT',
  headers: {Authorization: 'Bearer <token>', 'Content-Type': 'application/json'},
  body: JSON.stringify({role: 'admin', department: 'Sales'})
};

fetch('https://app.base44.com/api/apps/{app_id}/entities/User/{user_id}', options)
  .then(res => res.json())
  .then(res => console.log(res))
  .catch(err => console.error(err));

<?php

$curl = curl_init();

curl_setopt_array($curl, [
  CURLOPT_URL => "https://app.base44.com/api/apps/{app_id}/entities/User/{user_id}",
  CURLOPT_RETURNTRANSFER => true,
  CURLOPT_ENCODING => "",
  CURLOPT_MAXREDIRS => 10,
  CURLOPT_TIMEOUT => 30,
  CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
  CURLOPT_CUSTOMREQUEST => "PUT",
  CURLOPT_POSTFIELDS => json_encode([
    'role' => 'admin',
    'department' => 'Sales'
  ]),
  CURLOPT_HTTPHEADER => [
    "Authorization: Bearer <token>",
    "Content-Type: application/json"
  ],
]);

$response = curl_exec($curl);
$err = curl_error($curl);

curl_close($curl);

if ($err) {
  echo "cURL Error #:" . $err;
} else {
  echo $response;
}

package main

import (
	"fmt"
	"strings"
	"net/http"
	"io"
)

func main() {

	url := "https://app.base44.com/api/apps/{app_id}/entities/User/{user_id}"

	payload := strings.NewReader("{\n  \"role\": \"admin\",\n  \"department\": \"Sales\"\n}")

	req, _ := http.NewRequest("PUT", url, payload)

	req.Header.Add("Authorization", "Bearer <token>")
	req.Header.Add("Content-Type", "application/json")

	res, _ := http.DefaultClient.Do(req)

	defer res.Body.Close()
	body, _ := io.ReadAll(res.Body)

	fmt.Println(string(body))

}

HttpResponse<String> response = Unirest.put("https://app.base44.com/api/apps/{app_id}/entities/User/{user_id}")
  .header("Authorization", "Bearer <token>")
  .header("Content-Type", "application/json")
  .body("{\n  \"role\": \"admin\",\n  \"department\": \"Sales\"\n}")
  .asString();

require 'uri'
require 'net/http'

url = URI("https://app.base44.com/api/apps/{app_id}/entities/User/{user_id}")

http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true

request = Net::HTTP::Put.new(url)
request["Authorization"] = 'Bearer <token>'
request["Content-Type"] = 'application/json'
request.body = "{\n  \"role\": \"admin\",\n  \"department\": \"Sales\"\n}"

response = http.request(request)
puts response.read_body

{
  "id": "6874b0c2e1a94d0031bb77de",
  "email": "jane@acme.com",
  "full_name": "Jane Cooper",
  "role": "user",
  "collaborator_role": "editor",
  "created_date": "2026-06-01T09:23:41.481000Z",
  "updated_date": "2026-06-04T14:07:02.115000Z"
}

Authorizations

Authorization

string

header

required

Personal access token, sent as Authorization: Bearer <token>.

Path Parameters

user_id

string

required

ID of the user, as id in the response of List app users.

app_id

string

required

ID of the app the user belongs to.

Body

application/json

The fields to change. Any field other than role is stored on the user as sent.

role

string

New role for the user in the app, such as user or admin.

Example:

"admin"

Response

The updated user.

One user of an app.

string | null

ID of the user.

Example:

"6874b0c2e1a94d0031bb77de"

string | null

Email the user signs in with.

Example:

"jane@acme.com"

full_name

string | null

The user's name, or null if they haven't given one.

Example:

"Jane Cooper"

role

string | null

The user's role in the app. user and admin are built in, and an app can define its own.

Example:

"user"

collaborator_role

string | null

editor when the user can also edit the app in Base44, otherwise null.

Allowed value: "editor"

Example:

"editor"

created_date

string | null

When the user joined the app, as a UTC timestamp in ISO 8601 format.

Example:

"2026-06-01T09:23:41.481000Z"

updated_date

string | null

When the user's record last changed, as a UTC timestamp in ISO 8601 format.

Example:

"2026-06-04T14:07:02.115000Z"

Base44 APIs

Apps API (Beta)

Monitoring API

Audit Logs API

Update app user

Authorizations

Path Parameters

Body

Response