> ## Documentation Index
> Fetch the complete documentation index at: https://docs.base44.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Update pending invitee

> <Info>This API is in beta. Endpoints, fields, and behavior may still change, so avoid depending on it in production.</Info>

Sets custom `User` fields on someone who hasn't joined the app yet. When they join, the values are copied onto their user record.

The fields you send are merged into the stored ones, and a field you leave out keeps its value. Built-in fields such as `email`, `full_name`, `role` and `id` are ignored. Field-level security rules on the `User` entity apply, and a value over 20,000 characters is refused. Once the person has joined, change them with [Update app user](/api-reference/update-app-user) instead, because this endpoint returns a 404 for them.

<Note>This endpoint accepts a personal API key belonging to a user with editor access to the app. A read-only key is refused, and workspace API keys are not accepted.</Note>



## OpenAPI

````yaml /developers/references/app-management/app-management-openapi.json put /api/apps/{app_id}/access-requests/{request_id}
openapi: 3.1.0
info:
  title: Base44 App Management API
  version: 1.0.0
servers:
  - url: https://app.base44.com
security:
  - PersonalAccessTokenAuth: []
paths:
  /api/apps/{app_id}/access-requests/{request_id}:
    put:
      summary: Update pending invitee
      description: >-
        <Info>This API is in beta. Endpoints, fields, and behavior may still
        change, so avoid depending on it in production.</Info>


        Sets custom `User` fields on someone who hasn't joined the app yet. When
        they join, the values are copied onto their user record.


        The fields you send are merged into the stored ones, and a field you
        leave out keeps its value. Built-in fields such as `email`, `full_name`,
        `role` and `id` are ignored. Field-level security rules on the `User`
        entity apply, and a value over 20,000 characters is refused. Once the
        person has joined, change them with [Update app
        user](/api-reference/update-app-user) instead, because this endpoint
        returns a 404 for them.


        <Note>This endpoint accepts a personal API key belonging to a user with
        editor access to the app. A read-only key is refused, and workspace API
        keys are not accepted.</Note>
      operationId: update_access_request_api_apps__app_id__access_requests__request_id__put
      parameters:
        - name: request_id
          in: path
          required: true
          schema:
            type: string
            description: >-
              ID of the access request, as `id` in the response of [List access
              requests](/api-reference/list-access-requests).
            title: Request Id
          description: >-
            ID of the access request, as `id` in the response of [List access
            requests](/api-reference/list-access-requests).
          example: 68d4a1f7c2b9e5001a7f3c60
        - name: app_id
          in: path
          required: true
          schema:
            type: string
            description: ID of the app.
            title: App Id
          description: ID of the app.
          example: 6820f3a4e7b91d003c45a1f2
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/UpdateAccessRequestPayload'
      responses:
        '200':
          description: The invitation's custom fields after the update.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/UpdatedInvitation'
        '400':
          description: A field value is over 20,000 characters.
        '401':
          description: Missing or invalid credentials.
        '403':
          description: >-
            You don't have editor access to this app, a field-level security
            rule refuses a field you're changing, or your API key is read-only.
        '404':
          description: >-
            App not found, or the app has no pending invitation with this ID,
            including one the person already accepted.
        '422':
          description: '`data` is missing, or isn''t a JSON object.'
components:
  schemas:
    UpdateAccessRequestPayload:
      properties:
        data:
          additionalProperties: true
          type: object
          title: Data
          description: >-
            Custom `User` fields to set on the invitation, as field names and
            values.
          example:
            department: sales
            team: EMEA
      type: object
      required:
        - data
      title: UpdateAccessRequestPayload
    UpdatedInvitation:
      properties:
        success:
          type: boolean
          title: Success
          description: >-
            Always `true`. An update that doesn't happen returns an error
            instead.
          example: true
        data:
          additionalProperties: true
          type: object
          title: Data
          description: >-
            The invitation's custom `User` fields after the update, limited by
            the `User` entity's field-level read rules.
          example:
            department: sales
            team: EMEA
      type: object
      required:
        - success
        - data
      title: UpdatedInvitation
      description: 'Doc-only: the handler returns a plain dict with exactly these keys.'
  securitySchemes:
    PersonalAccessTokenAuth:
      type: http
      scheme: bearer
      description: 'Personal access token, sent as `Authorization: Bearer <token>`.'

````