Update a User

Update a user.

These are the attributes that can be updated at the root level:

• app_metadata
• blocked
• email
• email_verified
• family_name
• given_name
• name
• nickname
• password
• phone_number
• phone_verified
• picture
• username
• user_metadata
• verify_email

Some considerations:

• The properties of the new object will replace the old ones.
• The metadata fields are an exception to this rule (user_metadata and app_metadata). These properties are merged instead of being replaced but be careful, the merge only occurs on the first level.
• If you are updating email, email_verified, phone_number, phone_verified, username or password of a secondary identity, you need to specify the connection property too.
• If you are updating email or phone_number you can specify, optionally, the client_id property.
• Updating email_verified is not supported for enterprise and passwordless sms connections.
• Updating the blocked to false does not affect the user’s blocked state from an excessive amount of incorrectly provided credentials. Use the “Unblock a user” endpoint from the “User Blocks” API to change the user’s state.
• Supported attributes can be unset by supplying null as the value.

Updating a field (non-metadata property)

To mark the email address of a user as verified, the body to send should be:

{ "email_verified": true }

Updating a user metadata root property

Let’s assume that our test user has the following user_metadata:

{ "user_metadata" : { "profileCode": 1479 } }

To add the field addresses the body to send should be:

{ "user_metadata" : { "addresses": {"work_address": "100 Industrial Way"} }}

The modified object ends up with the following user_metadata property:

{
  "user_metadata": {
    "profileCode": 1479,
    "addresses": { "work_address": "100 Industrial Way" }
  }
}

Updating an inner user metadata property

If there’s existing user metadata to which we want to add "home_address": "742 Evergreen Terrace" (using the addresses property) we should send the whole addresses object. Since this is a first-level object, the object will be merged in, but its own properties will not be. The body to send should be:

{
  "user_metadata": {
    "addresses": {
      "work_address": "100 Industrial Way",
      "home_address": "742 Evergreen Terrace"
    }
  }
}

The modified object ends up with the following user_metadata property:

{
  "user_metadata": {
    "profileCode": 1479,
    "addresses": {
      "work_address": "100 Industrial Way",
      "home_address": "742 Evergreen Terrace"
    }
  }
}

PATCH https://{tenantDomain}/api/v2/users/{id}

Go

Go

package example

import (
    context "context"

    management "github.com/auth0/go-auth0/management/management"
    client "github.com/auth0/go-auth0/management/management/client"
    option "github.com/auth0/go-auth0/management/management/option"
)

func do() {
    client := client.NewClient(
        option.WithToken(
            "<token>",
        ),
    )
    request := &management.UpdateUserRequestContent{}
    client.Users.Update(
        context.TODO(),
        "id",
        request,
    )
}

import { ManagementClient } from "auth0";

async function main() {
    const client = new ManagementClient({
        token: "<token>",
    });
    await client.users.update("id", {});
}
main();

import { ManagementClient } from "auth0";

async function main() {
    const client = new ManagementClient({
        token: "<token>",
    });
    await client.users.update("id", {});
}
main();

curl --request PATCH \
  --url https://{tenantDomain}/api/v2/users/{id} \
  --header 'Authorization: Bearer <token>' \
  --header 'Content-Type: application/json' \
  --data '
{
  "blocked": false,
  "email_verified": false,
  "email": "[e-mail]",
  "phone_number": "[phone]",
  "phone_verified": false,
  "user_metadata": {},
  "app_metadata": {},
  "given_name": "John",
  "family_name": "Doe",
  "name": "John Doe",
  "nickname": "Johnny",
  "picture": "https://secure.gravatar.com/avatar/15626c5e0c749cb912f9d1ad48dba440?s=480&r=pg&d=https%3A%2F%2Fssl.gstatic.com%2Fs2%2Fprofiles%2Fimages%2Fsilhouette80.png",
  "verify_email": false,
  "verify_phone_number": false,
  "password": "secret",
  "connection": "Initial-Connection",
  "client_id": "DaM8bokEXBWrTUFCiJjWn50jei6ardyX",
  "username": "johndoe"
}
'

import requests

url = "https://{tenantDomain}/api/v2/users/{id}"

payload = {
    "blocked": False,
    "email_verified": False,
    "email": "[e-mail]",
    "phone_number": "[phone]",
    "phone_verified": False,
    "user_metadata": {},
    "app_metadata": {},
    "given_name": "John",
    "family_name": "Doe",
    "name": "John Doe",
    "nickname": "Johnny",
    "picture": "https://secure.gravatar.com/avatar/15626c5e0c749cb912f9d1ad48dba440?s=480&r=pg&d=https%3A%2F%2Fssl.gstatic.com%2Fs2%2Fprofiles%2Fimages%2Fsilhouette80.png",
    "verify_email": False,
    "verify_phone_number": False,
    "password": "secret",
    "connection": "Initial-Connection",
    "client_id": "DaM8bokEXBWrTUFCiJjWn50jei6ardyX",
    "username": "johndoe"
}
headers = {
    "Authorization": "Bearer <token>",
    "Content-Type": "application/json"
}

response = requests.patch(url, json=payload, headers=headers)

print(response.text)

<?php

$curl = curl_init();

curl_setopt_array($curl, [
  CURLOPT_URL => "https://{tenantDomain}/api/v2/users/{id}",
  CURLOPT_RETURNTRANSFER => true,
  CURLOPT_ENCODING => "",
  CURLOPT_MAXREDIRS => 10,
  CURLOPT_TIMEOUT => 30,
  CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
  CURLOPT_CUSTOMREQUEST => "PATCH",
  CURLOPT_POSTFIELDS => json_encode([
    'blocked' => false,
    'email_verified' => false,
    'email' => '[e-mail]',
    'phone_number' => '[phone]',
    'phone_verified' => false,
    'user_metadata' => [
        
    ],
    'app_metadata' => [
        
    ],
    'given_name' => 'John',
    'family_name' => 'Doe',
    'name' => 'John Doe',
    'nickname' => 'Johnny',
    'picture' => 'https://secure.gravatar.com/avatar/15626c5e0c749cb912f9d1ad48dba440?s=480&r=pg&d=https%3A%2F%2Fssl.gstatic.com%2Fs2%2Fprofiles%2Fimages%2Fsilhouette80.png',
    'verify_email' => false,
    'verify_phone_number' => false,
    'password' => 'secret',
    'connection' => 'Initial-Connection',
    'client_id' => 'DaM8bokEXBWrTUFCiJjWn50jei6ardyX',
    'username' => 'johndoe'
  ]),
  CURLOPT_HTTPHEADER => [
    "Authorization: Bearer <token>",
    "Content-Type: application/json"
  ],
]);

$response = curl_exec($curl);
$err = curl_error($curl);

curl_close($curl);

if ($err) {
  echo "cURL Error #:" . $err;
} else {
  echo $response;
}

HttpResponse<String> response = Unirest.patch("https://{tenantDomain}/api/v2/users/{id}")
  .header("Authorization", "Bearer <token>")
  .header("Content-Type", "application/json")
  .body("{\n  \"blocked\": false,\n  \"email_verified\": false,\n  \"email\": \"[e-mail]\",\n  \"phone_number\": \"[phone]\",\n  \"phone_verified\": false,\n  \"user_metadata\": {},\n  \"app_metadata\": {},\n  \"given_name\": \"John\",\n  \"family_name\": \"Doe\",\n  \"name\": \"John Doe\",\n  \"nickname\": \"Johnny\",\n  \"picture\": \"https://secure.gravatar.com/avatar/15626c5e0c749cb912f9d1ad48dba440?s=480&r=pg&d=https%3A%2F%2Fssl.gstatic.com%2Fs2%2Fprofiles%2Fimages%2Fsilhouette80.png\",\n  \"verify_email\": false,\n  \"verify_phone_number\": false,\n  \"password\": \"secret\",\n  \"connection\": \"Initial-Connection\",\n  \"client_id\": \"DaM8bokEXBWrTUFCiJjWn50jei6ardyX\",\n  \"username\": \"johndoe\"\n}")
  .asString();

require 'uri'
require 'net/http'

url = URI("https://{tenantDomain}/api/v2/users/{id}")

http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true

request = Net::HTTP::Patch.new(url)
request["Authorization"] = 'Bearer <token>'
request["Content-Type"] = 'application/json'
request.body = "{\n  \"blocked\": false,\n  \"email_verified\": false,\n  \"email\": \"[e-mail]\",\n  \"phone_number\": \"[phone]\",\n  \"phone_verified\": false,\n  \"user_metadata\": {},\n  \"app_metadata\": {},\n  \"given_name\": \"John\",\n  \"family_name\": \"Doe\",\n  \"name\": \"John Doe\",\n  \"nickname\": \"Johnny\",\n  \"picture\": \"https://secure.gravatar.com/avatar/15626c5e0c749cb912f9d1ad48dba440?s=480&r=pg&d=https%3A%2F%2Fssl.gstatic.com%2Fs2%2Fprofiles%2Fimages%2Fsilhouette80.png\",\n  \"verify_email\": false,\n  \"verify_phone_number\": false,\n  \"password\": \"secret\",\n  \"connection\": \"Initial-Connection\",\n  \"client_id\": \"DaM8bokEXBWrTUFCiJjWn50jei6ardyX\",\n  \"username\": \"johndoe\"\n}"

response = http.request(request)
puts response.read_body

200

{
  "user_id": "auth0|507f1f77bcf86cd799439020",
  "email": "[e-mail]",
  "email_verified": false,
  "username": "johndoe",
  "phone_number": "[phone]",
  "phone_verified": false,
  "created_at": "2023-11-07T05:31:56Z",
  "updated_at": "2023-11-07T05:31:56Z",
  "identities": [
    {
      "connection": "<string>",
      "user_id": "abc",
      "isSocial": true,
      "access_token": "<string>",
      "access_token_secret": "<string>",
      "refresh_token": "<string>",
      "profileData": {
        "email": "<string>",
        "email_verified": true,
        "name": "<string>",
        "username": "johndoe",
        "given_name": "<string>",
        "phone_number": "<string>",
        "phone_verified": true,
        "family_name": "<string>"
      }
    }
  ],
  "app_metadata": {},
  "user_metadata": {},
  "picture": "<string>",
  "name": "<string>",
  "nickname": "<string>",
  "multifactor": [
    "<string>"
  ],
  "multifactor_last_modified": "2023-11-07T05:31:56Z",
  "last_ip": "<string>",
  "last_login": "2023-11-07T05:31:56Z",
  "last_password_reset": "2023-11-07T05:31:56Z",
  "logins_count": 123,
  "blocked": true,
  "given_name": "<string>",
  "family_name": "<string>"
}

Autorisations

bearerAuthoAuth2ClientCredentials

Authorization · string · header · requis

Bearer authentication header of the form Bearer <token>, where <token> is your auth token.

En-têtes

auth0-custom-domain · string

Custom domain to be used for this request

Required string length: 3 - 255

Paramètres de chemin

id · string · requis

ID of the user to update.

Corps

application/jsonapplication/x-www-form-urlencoded

blocked · boolean · défaut: false

Whether this user was blocked by an administrator (true) or not (false).

email_verified · boolean · défaut: false

Whether this email address is verified (true) or unverified (false). If set to false the user will not receive a verification email unless verify_email is set to true.

email · string<email> | null · défaut: [e-mail]

Email address of this user.

phone_number · string | null · défaut: [phone]

The user's phone number (following the E.164 recommendation).

Pattern: ^\+[0-9]{1,15}$

phone_verified · boolean · défaut: false

Whether this phone number has been verified (true) or not (false).

user_metadata · object

User metadata to which this user has read/write access.

app_metadata · object

User metadata to which this user has read-only access.

given_name · string | null · défaut: John

Given name/first name/forename of this user.

Required string length: 1 - 150

family_name · string | null · défaut: Doe

Family name/last name/surname of this user.

Required string length: 1 - 150

name · string | null · défaut: John Doe

Name of this user.

Required string length: 1 - 300

nickname · string | null · défaut: Johnny

Preferred nickname or alias of this user.

Required string length: 1 - 300

picture · string<strict-uri> | null · défaut: https://secure.gravatar.com/avatar/15626c5e0c749cb912f9d1ad48dba440?s=480&r=pg&d=https%3A%2F%2Fssl.gstatic.com%2Fs2%2Fprofiles%2Fimages%2Fsilhouette80.png

URL to picture, photo, or avatar of this user.

verify_email · boolean · défaut: false

Whether this user will receive a verification email after creation (true) or no email (false). Overrides behavior of email_verified parameter.

verify_phone_number · boolean · défaut: false

Whether this user will receive a text after changing the phone number (true) or no text (false). Only valid when changing phone number for SMS connections.

password · string | null · défaut: secret

New password for this user. Only valid for database connections.

Minimum string length: 1

connection · string · défaut: Initial-Connection

Name of the connection to target for this user update.

Minimum string length: 1

client_id · string · défaut: DaM8bokEXBWrTUFCiJjWn50jei6ardyX

Auth0 client ID. Only valid when updating email address.

Minimum string length: 1

username · string | null · défaut: johndoe

The user's username. Only valid if the connection requires a username.

Required string length: 1 - 128

Réponse

200

application/json

User successfully updated.

user_id · string · défaut: auth0|507f1f77bcf86cd799439020

ID of the user which can be used when interacting with other APIs.

email · string<email> · défaut: [e-mail]

Email address of this user.

email_verified · boolean · défaut: false

Whether this email address is verified (true) or unverified (false).

username · string · défaut: johndoe

Username of this user.

phone_number · string · défaut: [phone]

Phone number for this user. Follows the E.164 recommendation.

phone_verified · boolean · défaut: false

Whether this phone number has been verified (true) or not (false).

created_at · string<date-time>

Date and time when this user was created.

updated_at · string<date-time>

Date and time when this user was last updated/modified.

identities · object[]

Array of user identity objects when accounts are linked.

Show child attributes

app_metadata · object

User metadata to which this user has read-only access.

user_metadata · object

User metadata to which this user has read/write access.

picture · string

URL to picture, photo, or avatar of this user.

name · string

Name of this user.

nickname · string

Preferred nickname or alias of this user.

multifactor · string[]

List of multi-factor authentication providers with which this user has enrolled.

multifactor_last_modified · string<date-time>

Last date and time this user's multi-factor authentication providers were updated.

last_ip · string

Last IP address from which this user logged in.

last_login · string<date-time>

Last date and time this user logged in.

last_password_reset · string<date-time>

Last date and time this user had their password reset.

logins_count · integer

Total number of logins this user has performed.

blocked · boolean

Whether this user was blocked by an administrator (true) or is not (false).

given_name · string

Given name/first name/forename of this user.

family_name · string

Family name/last name/surname of this user.