> ## Documentation Index
> Fetch the complete documentation index at: https://docs.sidenet.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# Update user

> Updates an end user without minting a new session token: their display name, their per-provider tool credentials, and/or their group.

Credentials persist on the user, and everything the user touches — live sessions, workflow runs, scheduled workflows — reads through the same store, so a push here reaches all of them within a minute while a browser keeps the session token it already holds. A `null` entry deletes that provider's stored credentials (e.g. when a user disconnects an integration). A group change re-points live sessions and schedules.

Same `tools_auth` / `group_id` shapes as POST /v1/token. Credentials are encrypted at rest and never returned; only the providers you send are touched. Requires your organization API key, from your backend — a session token cannot call this.



## OpenAPI

````yaml /api-reference/openapi.json patch /v1/users/{userId}
openapi: 3.1.0
info:
  title: Sidenet API
  version: 1.0.0
  description: >-
    Sidenet HTTP endpoints exposed by the Sidenet Studio. All routes require an
    api key that can be generated through the studio in studio.sidenet.ai.
servers:
  - url: https://api.sidenet.ai
security:
  - bearerAuth: []
paths:
  /v1/users/{userId}:
    patch:
      tags:
        - Users & Groups
      summary: Update user
      description: >-
        Updates an end user without minting a new session token: their display
        name, their per-provider tool credentials, and/or their group.


        Credentials persist on the user, and everything the user touches — live
        sessions, workflow runs, scheduled workflows — reads through the same
        store, so a push here reaches all of them within a minute while a
        browser keeps the session token it already holds. A `null` entry deletes
        that provider's stored credentials (e.g. when a user disconnects an
        integration). A group change re-points live sessions and schedules.


        Same `tools_auth` / `group_id` shapes as POST /v1/token. Credentials are
        encrypted at rest and never returned; only the providers you send are
        touched. Requires your organization API key, from your backend — a
        session token cannot call this.
      parameters:
        - name: userId
          in: path
          required: true
          schema:
            type: string
            example: user_4821
          description: Your id for the end user (the `user_id` sent to POST /v1/token).
      requestBody:
        required: true
        content:
          application/json:
            schema:
              type: object
              properties:
                name:
                  type: string
                  nullable: true
                  example: Ada Lovelace
                  description: >-
                    New display name. `null` clears it; omit to leave it
                    untouched.
                tools_auth:
                  type: object
                  example:
                    8d3b1a75-6c02-4e59-b84f-27a9d5e10c63:
                      credentials:
                        token: fresh CRM token
                group_id:
                  type: string
                  example: grp_84f20c19
                  description: >-
                    Move the user to this group. An unseen id creates the group;
                    rename or cap it via `PATCH /v1/groups/{groupId}`.
      responses:
        '200':
          description: What was updated
          content:
            application/json:
              schema:
                type: object
                properties:
                  user:
                    type: object
                    properties:
                      id:
                        type: string
                        description: Your id for the end user.
                      name:
                        type: string
                        nullable: true
                        description: Display name after this update.
                  providers:
                    type: array
                    items:
                      type: string
                    description: Provider ids whose stored credentials were replaced.
                  removed_providers:
                    type: array
                    items:
                      type: string
                    description: >-
                      Provider ids whose stored credentials were deleted (null
                      entries).
                  sessions_refreshed:
                    type: integer
                    description: Live sessions re-pointed at the new group.
                  schedules_refreshed:
                    type: integer
                    description: Scheduled workflows re-pointed at the new group.
                  group_id:
                    type: string
                    nullable: true
                    description: The group the user was moved to, when one was sent.
        '400':
          description: Invalid body
        '403':
          description: Not an API key
        '404':
          description: Unknown user in this organization
        '500':
          description: SESSION_CRED_KEY not configured while tools_auth was sent
components:
  securitySchemes:
    bearerAuth:
      type: http
      scheme: bearer
      description: >-
        Organization API key, generated in studio.sidenet.ai. Backend only —
        never in a browser.

````