Update Clients Endpoints

Update RBAC Client

PUT /v1/endpoints/{id}/rbac/clients/{client_id}

Edit a client's profile or rotate credentials. Profile fields (identifier, display_name, email, metadata, status) are written from the request on every call, so omitting one sends an empty value and clears it — send the full desired state. Credential fields (username, password, token) are only touched when non-empty, so omitting them leaves the existing credential intact.

To rotate credentials: pass a new password and/or token — the old hashes are replaced. Pass auto_generate_token: true to mint a fresh token; the new value comes back in generated_token (only once). Role/membership changes are not handled here — use /rbac/memberships. Any identities in the body are ignored on update.

Changing status here is OK but PUT .../status is the dedicated route used by the dashboard's disable/reactivate button.

Path parameters

id string (uuid) Req

Endpoint UUID.

client_id int64 Req

RBAC client ID.

Request body

Same field set as create (strict decoding — unknown fields are rejected), except identities is ignored and there is no role_ids:

identifier string Req

Stable identifier (canonicalised lowercase). Must be non-empty.

display_name, email, metadata

Profile fields. Written on every call — omitting one clears it.

username, password, token

Credential fields. Empty/omitted = no change. Setting requires the corresponding endpoint auth method to be enabled.

auto_generate_token boolean

Mint a fresh token, returned once in the response.

status string

invited | active | disabled | revoked (empty defaults to active). Prefer the dedicated status endpoint when only changing status.

Response (200 OK)

Updated client (same shape as list entries), plus generated_token if a fresh token was minted.

Errors

400 Bad Request

Strict decoding rejected unknown fields, missing/invalid identifier, invalid status, or attempt to use a disabled credential method.

401 Unauthorized

Missing auth.

403 Forbidden

Caller lacks the endpoints:update permission in the active account.

404 Not Found

Endpoint doesn't belong to the calling account, or client not found.

409 Conflict

Username/email collision with another client on this endpoint.

Request — rotate token
curl -X PUT "https://api.ngris.com/v1/endpoints/<uuid>/rbac/clients/11" \
  -H "X-API-KEY: <your_api_key>" \
  -H "Content-Type: application/json" \
  -d '{"identifier": "alice@example.com", "auto_generate_token": true}'

Python
from ngris import Ngris

client = Ngris(api_key="<your_api_key>")
client.endpoint_rbac.update_client(
    "<endpoint_uuid>", "11",
    {"identifier": "alice@example.com", "display_name": "Alice Smith"},
)

Response — 200 OK
{
  "id": 11,
  "identifier": "alice@example.com",
  "display_name": "Alice Smith",
  "status": "active",
  "has_password": true,
  "has_token": true,
  "has_oauth": false,
  "created_at": "2026-04-01T00:00:00Z",
  "updated_at": "2026-04-29T14:00:00Z"
}

PreviousCreate Client NextDelete Client

On this page

Update RBAC Client