Members

$envless->members->update()

Reassign a member to a different role

php
/**
 * @param MemberPatch $patch
 * @return MemberResource
 */
public function update(
    string $id,
    array $patch,
    int|float|null $timeout = null,
): array

Changes a member role. roleId is the only mutable field, and id is the workspace member id from the list methods, not the user id. Sending the role the member already holds is a no op that still returns the unchanged member.

The guards are strict: you cannot change your own role (member.self_mutation), you cannot touch the workspace owner (member.owner_immutable), and you cannot promote anyone into the owner role (role.owner_not_assignable).

The side effect to plan for is key re-clamping. Every API key owned by that member is re-checked against the new role permissions on success, so keys holding scopes the new role does not grant lose them immediately and start failing with 403.

Example

php
use Envless\Envless;

$envless = new Envless();

$page = $envless->members->list(limit: 100);
$target = null;
$admin = null;

foreach ($page->items as $member) {
    if (($member['user']['email'] ?? '') === 'dev@example.com') {
        $target = $member;
    }
}

foreach ($envless->roles->listAll() as $role) {
    if ($role['systemKey'] === 'admin') {
        $admin = $role;
    }
}

if ($target !== null && $admin !== null) {
    $updated = $envless->members->update($target['id'], [
        'roleId' => $admin['id'],
    ]);

    echo $updated['role']['name'] ?? 'no role', PHP_EOL;
}

Parameters

ParameterTypeRequiredDescription
$idstringYesWorkspace member id from the list methods, not the user id.
$patchMemberPatchYesThe fields below, as one array.
$patch['roleId']stringYesRole id from the roles namespace to assign to the member.
$timeoutint|floatNoSeconds each attempt of this call may take, the response body included, before it throws Envless\Exception\NetworkException with isTimeout() true. Overrides the client's timeout for this call, and 0 turns the limit off.

Returns

MemberResource reflecting the stored membership after the patch.

Worth knowing

  • No slug form is accepted for id. A user id here fails with member.not_found.
  • The no op check runs before the owner guard, so re-sending the owner current role succeeds while any real change is refused.
  • A member whose keys were narrowed by this call has to be issued new keys. There is no unclamp.

Required scopes

members:write

Underlying endpoint

PATCH /members/{id}

Request and response schema, every error code, and a live playground.

In TypeScript

envless.members.update()

The same method in @goenvless/sdk, with the same request, retries and errors.