Update RBAC Client

PUT /v1/endpoints/{uuid}/rbac/clients/{client_uuid}

Edit a client's profile or rotate credentials. Profile fields (identifier, display_name, email, metadata, status) are written from the request on every call, so omitting one sends an empty value and clears it — send the full desired state. Credential fields (username, password, token) are only touched when non-empty, so omitting them leaves the existing credential intact.

To rotate credentials: pass a new password and/or token — the old hashes are replaced. Pass auto_generate_token: true to mint a fresh token; the new value comes back in generated_token (only once). A token — minted or sent — needs bearer-token sign-in enabled on the endpoint (enabled_auth_methods.bearer_token in its settings); otherwise the call is refused with 400 bearer token authentication is not enabled for this endpoint. The same goes for username/password and username/password sign-in. Role/membership changes are not handled here — use /rbac/memberships. Any identities in the body are ignored on update.

Changing status here is OK but PUT .../status is the dedicated route used by the dashboard's disable/reactivate button.

Path parameters

uuid string (uuid) Req
The endpoint's uuid from /endpoints.
client_uuid string (uuid) Req
The RBAC client's uuid. Resolved under this endpoint only.

Deprecated: the legacy integer id is still accepted in the path until the sunset, answered with Deprecation and Sunset headers. Use the uuid.

Request body

Same field set as create (strict decoding — unknown fields are rejected), except identities is ignored and there is no role_ids:

identifier string Req
Stable identifier (canonicalised lowercase). Must be non-empty.
display_name, email, metadata
Profile fields. Written on every call — omitting one clears it.
username, password, token
Credential fields. Empty/omitted = no change. Setting requires the corresponding endpoint auth method to be enabled.
auto_generate_token boolean
Mint a fresh token, returned once in the response. Requires bearer-token sign-in enabled on the endpoint (400 otherwise).
status string
invited | active | disabled | revoked (empty defaults to active). Prefer the dedicated status endpoint when only changing status.

Response (200 OK)

Updated client (same shape as list entries), plus generated_token if a fresh token was minted.

Deprecated: until the sunset this response also carries the legacy integer id and *_id fields. Don't use them; read uuid and the *_uuid fields.

Errors

400 Bad Request
Strict decoding rejected unknown fields, missing/invalid identifier, invalid status, or a credential for a sign-in method the endpoint has off: bearer token authentication is not enabled for this endpoint (a token or auto_generate_token while bearer_token is off), username/password authentication is not enabled for this endpoint. An integer client id after the sunset (integer_id_unsupported).
401 Unauthorized
Missing auth.
403 Forbidden
Caller lacks the endpoints:update permission in the active account.
404 Not Found
Endpoint doesn't belong to the calling account, or the client isn't a client of this endpoint (client not found).
409 Conflict
Username/email collision with another client on this endpoint. Also "code": "quota_paused" when the endpoint is paused over your plan's limits.
Request — rotate token
curl -X PUT "https://api.ngris.com/v1/endpoints/019bb1e4-e785-77d2-9966-c3cff31d0a0e/rbac/clients/019b4b9d-d300-736b-8601-153b3d9f70ee" \ -H "X-API-KEY: <your_api_key>" \ -H "Content-Type: application/json" \ -d '{"identifier": "alice@example.com", "display_name": "Alice Smith", "auto_generate_token": true}'
Python
from ngris import Ngris client = Ngris(api_key="<your_api_key>") client.endpoint_rbac.update_client( "019bb1e4-e785-77d2-9966-c3cff31d0a0e", "019b4b9d-d300-736b-8601-153b3d9f70ee", {"identifier": "alice@example.com", "display_name": "Alice Smith"}, )
Response — 200 OK
{ "uuid": "019b4b9d-d300-736b-8601-153b3d9f70ee", "identifier": "alice@example.com", "display_name": "Alice Smith", "status": "active", "has_password": true, "has_token": true, "has_oauth": false, "registration_source": "admin", "created_at": "2026-04-01T00:00:00Z", "updated_at": "2026-04-29T14:00:00Z", "generated_token": "et_7c1e9a4f2b6d8e0a3c5f7b9d1e3a5c7f9b2d4e6a8c0e2f4a6b8d0c2e4f6a8b0c" }
Response — 400 Bad Request (bearer tokens off)
{ "error": "bearer token authentication is not enabled for this endpoint" }
Was this helpful?
On this page
Update RBAC Client
Was this helpful?
Homepage Docs Dashboard Docs API Docs nvelox Dashboard