# Update user (global)

Updates a user’s information globally. Provide the user ID as a path parameter and include the fields to update in the request body. The route supports partial updates—only the provided fields are changed. For identifier fields such as emails or phones, new items are added instead of replacing existing ones.

Endpoint: PUT /resources/users/v1/{userId}
Security: bearer

## Path parameters:

  - `userId` (string, required)

## Request fields (application/json):

  - `phoneNumber` (string)

  - `profilePictureUrl` (string,null)

  - `metadata` (string)
    Stringified JSON object
    Example: "{}"

  - `vendorMetadata` (string)
    Extra vendor-only data. stringified JSON object

  - `mfaBypass` (boolean)
    Indicates whether MFA should be bypassed for this user

  - `externalId` (string)
    The external id of the user

  - `name` (string)

## Response 200 fields (application/json):

  - `id` (string, required)

  - `email` (string, required)

  - `name` (string, required)

  - `profilePictureUrl` (string, required)

  - `sub` (string, required)

  - `verified` (boolean, required)

  - `mfaEnrolled` (boolean, required)

  - `mfaBypass` (boolean)

  - `phoneNumber` (string)

  - `roles` (array, required)

  - `roles.vendorId` (string, required)

  - `roles.tenantId` (string, required)

  - `roles.key` (string, required)

  - `roles.description` (string, required)

  - `roles.isDefault` (boolean, required)

  - `roles.firstUserRole` (boolean, required)

  - `roles.level` (number, required)

  - `roles.createdAt` (string, required)

  - `roles.updatedAt` (string, required)

  - `roles.permissions` (array, required)

  - `provider` (string, required)

  - `tenantIds` (array, required)

  - `activatedForTenant` (boolean)

  - `isLocked` (boolean)

  - `tenants` (array, required)

  - `tenants.temporaryExpirationDate` (string)

  - `tenants.isDisabled` (boolean)

  - `invisible` (boolean)

  - `superUser` (boolean)

  - `metadata` (string, required)

  - `vendorMetadata` (string, required)

  - `externalId` (string)

  - `lastLogin` (string, required)

  - `groups` (array)

  - `subAccountAccessAllowed` (boolean, required)

  - `managedBy` (string)
    Enum: "frontegg", "scim2", "external"