---
title: "Change a member's permissions"
description: "Set some of a member's permissions and replace the assistants they may use. Paid plans only."
canonical: "https://lookio.app/docs/api/members/update-member-permissions"
updated: "2026-10-17"
---

# Change a member's permissions

Requires `admin`.

Workspace admins only, with a personal connection.

You send the permissions to change, in `snake_case`: `resources_list`, `resources_create`, `resources_edit`, `resources_delete`, `assistants_create`, `assistants_edit`, `assistants_delete`, `api` and `mcp`. The others are kept. `assistant_ids` always **replaces** the member's list: send `null` for all assistants, including future ones. An unknown permission name fails with `invalid_request`.

Granular permissions need a paid plan. On the Free plan every member may do everything, and the call fails with `feature_not_available`. The change applies to the member's API and MCP connections at once.

```http
PATCH https://api.lookio.app/v1/members/{user_id}
```

## Authorizations

- `Authorization` (bearer, in header, required)

## Path parameters

- `user_id` (`string`, required)

## Body

`application/json`, required

- `permissions` (`object`, required): Each permission to set. Missing ones are refused for members on the Pro plan.
- `permissions.resources_list` (`boolean`)
- `permissions.resources_create` (`boolean`)
- `permissions.resources_edit` (`boolean`)
- `permissions.resources_delete` (`boolean`)
- `permissions.assistants_create` (`boolean`)
- `permissions.assistants_edit` (`boolean`)
- `permissions.assistants_delete` (`boolean`)
- `permissions.api` (`boolean`)
- `permissions.mcp` (`boolean`)
- `assistant_ids` (`string[] | null`, required): The assistants this member may use; null for all, including future ones.

## Response

**200**: Change a member's permissions

- `data` (`object`, required)
- `data.user_id` (`string`, required)
- `data.email` (`string,null`, required)
- `data.name` (`string,null`, required)
- `data.role` (`enum<string>`, required, one of: `admin, member`)
- `data.permissions` (`object`, required)
- `data.permissions.resources_list` (`boolean`, required)
- `data.permissions.resources_create` (`boolean`, required)
- `data.permissions.resources_edit` (`boolean`, required)
- `data.permissions.resources_delete` (`boolean`, required)
- `data.permissions.assistants_create` (`boolean`, required)
- `data.permissions.assistants_edit` (`boolean`, required)
- `data.permissions.assistants_delete` (`boolean`, required)
- `data.permissions.api` (`boolean`, required)
- `data.permissions.mcp` (`boolean`, required)
- `data.assistant_ids` (`string[] | null`, required): The assistants this member may use; null is all of them.
- `request_id` (`string`, required)

```json
{
  "data": {
    "user_id": "<string>",
    "email": null,
    "name": null,
    "role": "admin",
    "permissions": {
      "resources_list": true,
      "resources_create": true,
      "resources_edit": true,
      "resources_delete": true,
      "assistants_create": true,
      "assistants_edit": true,
      "assistants_delete": true,
      "api": true,
      "mcp": true
    },
    "assistant_ids": [
      "<string>"
    ]
  },
  "request_id": "<string>"
}
```

**400**: Possible codes: invalid_request, unknown_field, invalid_parameter, invalid_cursor

- `error` (`object`, required)
- `error.type` (`string`, required)
- `error.code` (`string`, required)
- `error.message` (`string`, required)
- `error.param` (`string`)
- `error.docs_url` (`string`, required)
- `error.action_url` (`string<uri>`)
- `request_id` (`string`, required)

```json
{
  "error": {
    "type": "<string>",
    "code": "<string>",
    "message": "<string>",
    "param": "<string>",
    "docs_url": "<string>",
    "action_url": "<string>"
  },
  "request_id": "<string>"
}
```

**401**: Possible codes: authentication_required, invalid_api_key, api_key_expired, api_key_revoked, invalid_access_key

- `error` (`object`, required)
- `error.type` (`string`, required)
- `error.code` (`string`, required)
- `error.message` (`string`, required)
- `error.param` (`string`)
- `error.docs_url` (`string`, required)
- `error.action_url` (`string<uri>`)
- `request_id` (`string`, required)

```json
{
  "error": {
    "type": "<string>",
    "code": "<string>",
    "message": "<string>",
    "param": "<string>",
    "docs_url": "<string>",
    "action_url": "<string>"
  },
  "request_id": "<string>"
}
```

**403**: Possible codes: insufficient_scope, feature_not_available, admin_required, permission_denied

- `error` (`object`, required)
- `error.type` (`string`, required)
- `error.code` (`string`, required)
- `error.message` (`string`, required)
- `error.param` (`string`)
- `error.docs_url` (`string`, required)
- `error.action_url` (`string<uri>`)
- `request_id` (`string`, required)

```json
{
  "error": {
    "type": "<string>",
    "code": "<string>",
    "message": "<string>",
    "param": "<string>",
    "docs_url": "<string>",
    "action_url": "<string>"
  },
  "request_id": "<string>"
}
```

**404**: Possible codes: resource_not_found

- `error` (`object`, required)
- `error.type` (`string`, required)
- `error.code` (`string`, required)
- `error.message` (`string`, required)
- `error.param` (`string`)
- `error.docs_url` (`string`, required)
- `error.action_url` (`string<uri>`)
- `request_id` (`string`, required)

```json
{
  "error": {
    "type": "<string>",
    "code": "<string>",
    "message": "<string>",
    "param": "<string>",
    "docs_url": "<string>",
    "action_url": "<string>"
  },
  "request_id": "<string>"
}
```

**413**: Possible codes: request_too_large

- `error` (`object`, required)
- `error.type` (`string`, required)
- `error.code` (`string`, required)
- `error.message` (`string`, required)
- `error.param` (`string`)
- `error.docs_url` (`string`, required)
- `error.action_url` (`string<uri>`)
- `request_id` (`string`, required)

```json
{
  "error": {
    "type": "<string>",
    "code": "<string>",
    "message": "<string>",
    "param": "<string>",
    "docs_url": "<string>",
    "action_url": "<string>"
  },
  "request_id": "<string>"
}
```

**429**: Possible codes: rate_limited

- `error` (`object`, required)
- `error.type` (`string`, required)
- `error.code` (`string`, required)
- `error.message` (`string`, required)
- `error.param` (`string`)
- `error.docs_url` (`string`, required)
- `error.action_url` (`string<uri>`)
- `request_id` (`string`, required)

```json
{
  "error": {
    "type": "<string>",
    "code": "<string>",
    "message": "<string>",
    "param": "<string>",
    "docs_url": "<string>",
    "action_url": "<string>"
  },
  "request_id": "<string>"
}
```

**500**: Possible codes: internal_error

- `error` (`object`, required)
- `error.type` (`string`, required)
- `error.code` (`string`, required)
- `error.message` (`string`, required)
- `error.param` (`string`)
- `error.docs_url` (`string`, required)
- `error.action_url` (`string<uri>`)
- `request_id` (`string`, required)

```json
{
  "error": {
    "type": "<string>",
    "code": "<string>",
    "message": "<string>",
    "param": "<string>",
    "docs_url": "<string>",
    "action_url": "<string>"
  },
  "request_id": "<string>"
}
```

**Example request**

```bash
curl --request PATCH \
  --url 'https://api.lookio.app/v1/members/<user_id>' \
  --header 'Authorization: <api-key>' \
  --header 'Content-Type: application/json' \
  --data '{
  "permissions": {
    "resources_list": true,
    "resources_create": true,
    "resources_edit": true,
    "resources_delete": true,
    "assistants_create": true,
    "assistants_edit": true,
    "assistants_delete": true,
    "api": true,
    "mcp": true
  },
  "assistant_ids": [
    "<string>"
  ]
}'
```