User by ID

Updated
  • Updated on Oct 19, 2026
  • Published on Jun 17, 2026
Prev Next
Patch
/public/v1/user-management/users/{userId}

Partially updates an existing user identified by userId. Only supplied (non-null) fields are applied — omitted fields remain unchanged.

Security

The requesting user must have one of the following permissions to update a user:

  • Administration → Users → Edit Users
  • Administration → Users → Edit Users in Bulk

Permission-change latency: changes to permissions take several minutes to propagate. A user may continue to operate under the previous permission set for a short period after a change.

Security
HTTP
Type Bearer
Header parameters
x-r365-context-tenant-id
stringRequired

Identifies the R365 tenant the request applies to. Required on every request.

Path parameters
userId
string (uuid) Required

The unique identifier of the user to update

Body parameters
Expand All
object
id
string (uuid)

Unique identifier of the patch user.

fullName
string
username
string
defaultLocation
string (uuid)
email
string
managedByBrand
string | null
mobileNumber
string | null
allLocationsAccess
boolean | null
allBrandFranchiseeLocationAccess
boolean | null
canGrantAccessBeyondPersonalLevel
boolean
inActive
boolean | null
userRoles
Array of object (GuidId)
object
id
string (uuid)

Unique identifier of the guid id.

locations
Array of object | null
object
id
string (uuid)

Unique identifier of the guid id.

externalLocations
Array of object | null
object
id
string (uuid)

Unique identifier of the external location.

tenant
string
reportRoles
Array of object | null
object
id
string (uuid)

Unique identifier of the guid id.

optionIds
Array of object | null
object
id
integer (int64)

Unique identifier of the entity reference long patch.

linkedToEmployee
string (uuid) | null

Identifier of the employee record to link this user to. Supplied as a bare GUID on the request; the GET response returns it as an object with id and name.

legalEntities
Array of object | null

Legal entities to scope this user to.

object
id
string (uuid)

Unique identifier of the guid id.

Responses
200

Users updated successfully.

Expand All
object
success
Array of object (UserCreated)
object
id
string (uuid)

Unique identifier of the user created.

username
string
errors
Array

Per-item failures. NOTE: the wire property is 'errors' (SuccessErrorsResponse), not 'userErrors'.

Example[]
400

Bad Request — a parameter value is malformed, of the wrong type, or outside its allowed range.

401

Unauthorized — the bearer token is missing, invalid or expired, or is not valid for the specified tenant.

403

Forbidden — the caller lacks the permission required for this operation.

404

Not Found — the requested resource does not exist, or the supplied continuation token is unknown or has expired.

409

Conflict — the request conflicts with the current state of the resource and cannot be applied.

422

Unprocessable Entity — a required parameter is missing, or a supplied parameter value is invalid.

429

Too Many Requests — the caller has exceeded the rate limit; retry after a short delay.

500

Internal Server Error — an unexpected error occurred while processing the request.