> ## Documentation Index
> Fetch the complete documentation index at: https://mintlify.com/open-webui/open-webui/llms.txt
> Use this file to discover all available pages before exploring further.

# Update User

Updates user information including role, name, email, profile image, and password.

## Authentication

Requires admin authentication.

## Path Parameters

<ParamField path="user_id" type="string" required>
  The unique identifier of the user to update
</ParamField>

## Request Body

<ParamField body="role" type="string" required>
  User role: `admin`, `user`, or `pending`
</ParamField>

<ParamField body="name" type="string" required>
  User display name
</ParamField>

<ParamField body="email" type="string" required>
  User email address (will be converted to lowercase)
</ParamField>

<ParamField body="profile_image_url" type="string" required>
  URL to user's profile image (validated for security)
</ParamField>

<ParamField body="password" type="string" optional>
  New password for the user (will be hashed). If provided, must meet password requirements.
</ParamField>

## Response

Returns the updated user object.

<ResponseField name="id" type="string">
  Unique user identifier
</ResponseField>

<ResponseField name="email" type="string">
  Updated email address
</ResponseField>

<ResponseField name="username" type="string" optional>
  Username
</ResponseField>

<ResponseField name="role" type="string">
  Updated user role
</ResponseField>

<ResponseField name="name" type="string">
  Updated display name
</ResponseField>

<ResponseField name="profile_image_url" type="string">
  Updated profile image URL
</ResponseField>

<ResponseField name="last_active_at" type="integer">
  Unix timestamp of last activity
</ResponseField>

<ResponseField name="updated_at" type="integer">
  Unix timestamp of last update
</ResponseField>

<ResponseField name="created_at" type="integer">
  Unix timestamp of creation
</ResponseField>

## Example Request

```bash theme={null}
curl -X POST "https://your-domain.com/api/users/user-123/update" \
  -H "Authorization: Bearer YOUR_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{
    "role": "admin",
    "name": "John Doe",
    "email": "johndoe@example.com",
    "profile_image_url": "https://example.com/avatar.jpg",
    "password": "newSecurePassword123!"
  }'
```

## Example Response

```json theme={null}
{
  "id": "user-123",
  "email": "johndoe@example.com",
  "username": "johndoe",
  "role": "admin",
  "name": "John Doe",
  "profile_image_url": "https://example.com/avatar.jpg",
  "last_active_at": 1709424000,
  "updated_at": 1709424500,
  "created_at": 1709337600
}
```

## Errors

* `400` - Email already taken by another user
* `400` - Password does not meet requirements
* `400` - User not found
* `403` - Cannot modify primary admin user (if you're not the primary admin)
* `403` - Primary admin cannot change their own role from admin

## Notes

* Email addresses are automatically converted to lowercase
* Email uniqueness is enforced - returns error if email is already in use by another user
* Password is validated and hashed securely if provided
* Primary admin user (first user created) has special protections:
  * Cannot be modified by other admins
  * Cannot change their own role from admin
* Profile image URLs are validated for security
* Both user table and auth table are updated when changing email or password