> ## Documentation Index > Fetch the complete documentation index at: https://docs.base44.com/llms.txt > Use this file to discover all available pages before exploring further. # Update app user > This API is in beta. Endpoints, fields, and behavior may still change, so avoid depending on it in production. Changes a user's role or the extra fields the app stores on them, and returns the updated user. Send `role` to change the user's role. It isn't checked against the roles the app defines, so a misspelled role is saved as sent. If the user also belongs to a group shared with the app, they keep the highest role any of their groups gives them, so the `role` in the response can be higher than the one you sent. Only the app's owner can change the owner's role. Every other field you send is merged into the user's record. A field you leave out keeps its value. The fields aren't checked against the `User` schema, so a misspelled name is stored under that name. `email` and `full_name` belong to the user's account and are ignored, as are `id` and `collaborator_role`. Field-level security rules on the `User` entity apply. A `role` you send is saved before the other fields are checked, so a call rejected for another field, by one of those rules or for an oversized value, changes none of the other fields but still changes the role. Updating a user triggers the app's webhooks for the `User` entity. The response includes fields beyond the ones documented here. Don't rely on undocumented response fields, as they can change at any time. This endpoint accepts a personal API key belonging to a user with editor access to the app. A read-only key is refused, and workspace API keys are not accepted. ## OpenAPI ````yaml /developers/references/app-management/app-management-openapi.json put /api/apps/{app_id}/entities/User/{user_id} openapi: 3.1.0 info: title: Base44 App Management API version: 1.0.0 servers: - url: https://app.base44.com security: - PersonalAccessTokenAuth: [] paths: /api/apps/{app_id}/entities/User/{user_id}: put: summary: Update app user description: >- This API is in beta. Endpoints, fields, and behavior may still change, so avoid depending on it in production. Changes a user's role or the extra fields the app stores on them, and returns the updated user. Send `role` to change the user's role. It isn't checked against the roles the app defines, so a misspelled role is saved as sent. If the user also belongs to a group shared with the app, they keep the highest role any of their groups gives them, so the `role` in the response can be higher than the one you sent. Only the app's owner can change the owner's role. Every other field you send is merged into the user's record. A field you leave out keeps its value. The fields aren't checked against the `User` schema, so a misspelled name is stored under that name. `email` and `full_name` belong to the user's account and are ignored, as are `id` and `collaborator_role`. Field-level security rules on the `User` entity apply. A `role` you send is saved before the other fields are checked, so a call rejected for another field, by one of those rules or for an oversized value, changes none of the other fields but still changes the role. Updating a user triggers the app's webhooks for the `User` entity. The response includes fields beyond the ones documented here. Don't rely on undocumented response fields, as they can change at any time. This endpoint accepts a personal API key belonging to a user with editor access to the app. A read-only key is refused, and workspace API keys are not accepted. operationId: update_entity_api_apps__app_id__entities_User__user_id__put parameters: - name: user_id in: path required: true schema: type: string description: >- ID of the user, as `id` in the response of [List app users](/api-reference/list-app-users). title: User Id description: >- ID of the user, as `id` in the response of [List app users](/api-reference/list-app-users). example: 6874b0c2e1a94d0031bb77de - name: app_id in: path required: true schema: type: string description: ID of the app the user belongs to. title: App Id description: ID of the app the user belongs to. example: 6820f3a4e7b91d003c45a1f2 requestBody: required: true content: application/json: schema: type: object additionalProperties: true title: UpdateAppUser properties: role: type: string description: New role for the user in the app, such as `user` or `admin`. example: admin description: >- The fields to change. Any field other than `role` is stored on the user as sent. example: role: admin department: Sales responses: '200': description: The updated user. content: application/json: schema: type: object additionalProperties: true description: One user of an app. properties: id: anyOf: - type: string - type: 'null' description: ID of the user. example: 6874b0c2e1a94d0031bb77de title: Id email: anyOf: - type: string - type: 'null' description: Email the user signs in with. example: jane@acme.com title: Email full_name: anyOf: - type: string - type: 'null' description: The user's name, or `null` if they haven't given one. example: Jane Cooper title: Full Name role: anyOf: - type: string - type: 'null' description: >- The user's role in the app. `user` and `admin` are built in, and an app can define its own. example: user title: Role collaborator_role: anyOf: - const: editor type: string - type: 'null' description: >- `editor` when the user can also edit the app in Base44, otherwise `null`. example: editor title: Collaborator Role created_date: anyOf: - type: string - type: 'null' description: >- When the user joined the app, as a UTC timestamp in ISO 8601 format. example: '2026-06-01T09:23:41.481000Z' title: Created Date updated_date: anyOf: - type: string - type: 'null' description: >- When the user's record last changed, as a UTC timestamp in ISO 8601 format. example: '2026-06-04T14:07:02.115000Z' title: Updated Date title: AppUserRecord '400': description: >- You tried to change the app owner's role and you aren't the owner, or, on some apps, a field value is over 20,000 characters. '401': description: Missing or invalid credentials. '403': description: >- You don't have editor access to this app, a field-level security rule refuses a field you're changing, or your API key is read-only. '404': description: App not found, or the app has no user with this ID. '422': description: The body is missing, or isn't a JSON object. '429': description: >- Rate limit exceeded. The base limit is 70 requests per minute. See [Rate limits](/developers/references/apps-api/get-started/rate-limits) for the multiplier your plan gets. components: securitySchemes: PersonalAccessTokenAuth: type: http scheme: bearer description: 'Personal access token, sent as `Authorization: Bearer `.' ````