Update Role

Beta

PATCH/v1/identity/roles/{id}

Idempotent with Idempotency-Key header. Learn more

Updates a role's name or the set of permissions it grants.

Only roles owned by your account can be updated; the system-owned roles shared across all accounts are rejected. Permission changes apply to every user already assigned the role, starting with their next request.

Permissions requiredValues:roles:update

The role behind your API key or agent must grant every one of these permissions.

idstring

Role ID.

include[]optional arrayenumValues:ownerowner.accountpermissions

Sub-objects to expand in the response. When omitted, sub-objects are returned as null.

nameoptional string

New display name for the role.

Returns a conflict error if another role in your account already uses this name.

permissionsoptional array of string

Full replacement set of permissions, in {permission}:{action} format, such as customers:read.

The role's existing permissions are discarded and replaced with exactly what you send, so include every permission the role should keep. Sending an empty array strips the role of all access, while leaving the field out keeps the current permissions untouched.

idstring

Role ID.

objectstringenumValues:role

Resource type identifier.

namestring

Display name of the role.

Unique within the account.

typestringenumValues:adminuserscanner

The kind of role.

The type gates behavior that individual permissions do not cover, and some actions are reserved for a single role type.

admin: full administrative access. Sensitive areas such as API keys, billing, and third-party integrations are restricted to admins no matter what permissions another role holds.
user: a custom role tailored to a specific need, with its permissions defined explicitly. Roles created through the API always have this type.
scanner: the role used by shop-floor scanning stations, assigned automatically when a scanning-station user is created.
sales_rep: a role for sales representatives. Order analytics are scoped to the rep's own orders.
agent: a role assigned to an automated agent rather than a person.

ownerownerExpandablenullable

Provenance of this role.

System-owned roles are platform-provided defaults shared across all accounts and cannot be updated or deleted; account-owned roles are custom to your account.

objectstringenumValues:owner

Resource type identifier.

typestringenumValues:systemaccount

Where this resource came from.

system: a platform-provided default shared across all accounts; not editable.
account: created and owned by a specific account; the account field identifies which.

accountaccountExpandablenullable

The account that owns this resource.

Present only when type is account; system-owned resources have no owning account.

idstring

Account ID.

objectstringenumValues:account

Resource type identifier.

namestring

The account's display name.

default_billing_addressaddressnullable

The address billed by default on orders for this account.

Always returned as null in this endpoint.

default_shipping_addressaddressnullable

The address shipped to by default on orders for this account.

Always returned as null in this endpoint.

brandingaccount_brandingnullable

Customer-facing branding for the account, such as the logo, support contacts, and social links.

Always returned as null in this endpoint.

portalaccount_portalnullable

The account's customer portal settings, including the portal URL slug.

Always returned as null in this endpoint.

created_atstring (date-time)

Creation timestamp.

updated_atstring (date-time)

Last updated timestamp.

permissionsarray of stringExpandablenullable

Permissions granted by this role, in {permission}:{action} format, such as customers:read.

created_atstring (date-time)

Creation timestamp.

updated_atstring (date-time)

Last updated timestamp.

Responses

200

Successful response for Update Role

Update Role

import OpenMRP from '@openmrp/sdk';

const client = new OpenMRP({
  bearerToken: 'YOUR_API_KEY', // Your API key goes here
});

const role = await client.identity.roles.update('rl_3xknmfqflhvb', {
  name: 'Updated Manager',
  permissions: ['customers:read', 'customers:update'],
});

console.log(role.id);

import OpenMRP from '@openmrp/sdk';

const client = new OpenMRP({
  bearerToken: 'YOUR_API_KEY', // Your API key goes here
});

const role = await client.identity.roles.update('rl_3xknmfqflhvb', {
  name: 'Updated Manager',
  permissions: ['customers:read', 'customers:update'],
});

console.log(role.id);

200 example

{
  "id": "rl_3xknmfqflhvb",
  "object": "role",
  "name": "Admin",
  "type": "admin",
  "owner": {
    "object": "owner",
    "type": "account",
    "account": {
      "id": "ac_ykxoradjoeb3",
      "object": "account",
      "name": "Acme Inc.",
      "default_billing_address": null,
      "default_shipping_address": null,
      "branding": null,
      "portal": null,
      "created_at": "2026-05-10T00:00:00Z",
      "updated_at": "2026-05-10T00:23:00Z"
    }
  },
  "permissions": [
    "customers:create",
    "customers:read",
    "customers:update",
    "customers:delete"
  ],
  "created_at": "2026-05-10T00:00:00Z",
  "updated_at": "2026-05-10T00:23:00Z"
}

{
  "id": "rl_3xknmfqflhvb",
  "object": "role",
  "name": "Admin",
  "type": "admin",
  "owner": {
    "object": "owner",
    "type": "account",
    "account": {
      "id": "ac_ykxoradjoeb3",
      "object": "account",
      "name": "Acme Inc.",
      "default_billing_address": null,
      "default_shipping_address": null,
      "branding": null,
      "portal": null,
      "created_at": "2026-05-10T00:00:00Z",
      "updated_at": "2026-05-10T00:23:00Z"
    }
  },
  "permissions": [
    "customers:create",
    "customers:read",
    "customers:update",
    "customers:delete"
  ],
  "created_at": "2026-05-10T00:00:00Z",
  "updated_at": "2026-05-10T00:23:00Z"
}

Update Role

Authorization

Path Parameters

Query Parameters

Request Body

Returns

Responses