Update a user
Only the fields present in the body are changed.
Changing your own password or email requires current_password, because
that operation converts possession of a credential into lasting control
of the account. A non-user credential may not do it at all: an API key
carries its owner’s identity, so without this rule a scoped machine
credential could set the owner’s password and become an interactive
login. A caller holding user:manage may still reset somebody else’s
credentials, which is what that permission is for.
Changing role requires user:manage and is refused on your own
account. Changing the password ends every session that preceded it,
across the whole cluster and at once.
Authorizations
A machine credential, qk_ followed by its secret. Only a hash of the
secret is stored, so a key is displayed exactly once, when it is created
or rotated. A key reaches only the configurations it is linked to.
It may also be sent as Authorization: Bearer qk_..., which is
recognised by the prefix.
Path Parameters
The user's id.
Body
Every field is optional, and one that is absent is left alone rather than cleared.
12 - 1024Requires user:manage, and may never be changed on your own
account.
admin, user Required when changing the password or email address on your own account, and ignored when an administrator changes somebody else's.
Response
Updated.
admin is the only role that reaches user, policy and API key
management without an explicit policy statement.
admin, user