Change a member's role

PATCH/api/orgs/{org}/members/{handle}

updateOrgMember

Admin/Owner can change roles up to their own level. Demoting the last Owner is rejected.

Requires authentication using a bearer token or a session cookie — see tokens and scopes.

curl

curl -X PATCH 'https://neosource.dev/api/orgs/ORG/members/HANDLE' \
  -H 'Authorization: Bearer $NEOSOURCE_TOKEN' \
  -H 'Content-Type: application/json' \
  -d '{"role":"string"}'

fetch

fetch("https://neosource.dev/api/orgs/ORG/members/HANDLE", {
  method: "PATCH",
  headers: {
    Authorization: "Bearer $NEOSOURCE_TOKEN",
    "Content-Type": "application/json",
  },
  body: JSON.stringify({"role":"string"}),
});

Path parameters

orgrequired: string
handlerequired: Account handle (not UUID) — matches the SPA route shape.
string

Request bodyrequired

application/json

UpdateOrgMemberRequest

object

rolerequired: WorkspaceRole
string
Workspace membership role. Ordered low → high (`Member < Admin < Owner`) so that `if actor_role >= WorkspaceRole::Admin` reads naturally.
"member""admin""owner"

Responses

200Member updated

application/json

OrgMemberResponse

object

account_idrequired: string
display_namerequired: string
handlerequired: string
rolerequired: WorkspaceRole
string
Workspace membership role. Ordered low → high (`Member < Admin < Owner`) so that `if actor_role >= WorkspaceRole::Admin` reads naturally.
"member""admin""owner"

403Forbidden — one of: forbidden, needs_scope

application/json

one of

ErrorForbidden
NeedsScopeError
object
`403` body returned when listing private repos but the linked identity lacks the required provider scope. The SPA turns this into an incremental-authorization prompt (Tier 2) that calls the `/elevate` OAuth endpoint with this `scope`.
errorrequired
string
Always `needs_scope` — this body exists to carry the extra fields that kind needs.
"needs_scope"
scoperequired
string
The provider scope to request via elevation (e.g. `"repo"`).

Standard errors

Bodies documented once for the whole API — see standard errors.

400Bad Request — one of: invalid_input
401Authentication required
404Not Found — one of: not_found
409Conflict — one of: already_exists, conflict
429Rate limited — retry after the `Retry-After` header
500Internal server error
503Service temporarily unavailable / at capacity — retry after the `Retry-After` header
504Gateway timeout — the request exceeded the server's handling budget