---
title: Update a member of the workspace
description: "Self-edit profile fields (name, email, avatar_url) on a linked row, or — as owner/admin — change role on non-owner rows, or archive/unarchive any non-owner-floor-violating row."
api_method: PATCH
api_path: "/v1/workspaces/{workspaceId}/members/{memberId}"
canonical_url: https://wiblo.app/docs/developers/api/members/update-workspace-member
last_updated: 2026-08-03T21:24:33+02:00
md_url: https://wiblo.app/docs/developers/api/members/update-workspace-member.md
---

# Update a member of the workspace

`PATCH /v1/workspaces/{workspaceId}/members/{memberId}`

Self-edit profile fields (`name`, `email`, `avatar_url`) on a linked row, or — as owner/admin — change role on non-owner rows, or archive/unarchive any non-owner-floor-violating row. Field-level rules live in the `enforce_workspace_member_update_rules` trigger; archive operations route through the `set_member_archive_state` SECURITY DEFINER RPC so the post-UPDATE SELECT visibility check on the archived NEW row does not falsely reject. The Zod schema excludes `'owner'` from the role union; ownership grants via PATCH are rejected before the handler runs (`VALIDATION_FAILED` 400). Member callers attempting to mutate another linked member's profile collapse onto a 0-row UPDATE and surface as `MEMBER_NOT_FOUND` 404 (RLS hides the result, no existence leak). Per-user rate-limited at 60/60s.

## Path parameters

| Parameter | Type | Required | Description |
| --- | --- | --- | --- |
| `workspaceId` | `string` | Yes |  |
| `memberId` | `string` | Yes |  |

## Request body

| Field | Type | Required | Description |
| --- | --- | --- | --- |
| `name` | `string` | No |  |
| `email` | `string \| null` | No |  |
| `role` | `"admin" \| "member"` | No |  |
| `avatar_url` | `string \| null` | No |  |
| `accent_hue` | `"red" \| "coral" \| "orange" \| "green" \| "teal" \| "blue" \| ...` | No | The member's monogram accent key; `null` clears the pick so the tile returns to the derived colour. |
| `archived_at` | `string \| null` | No |  |

## Request

**curl**

```bash
curl https://api.wiblo.app/v1/workspaces/{workspaceId}/members/{memberId} \
  -X PATCH \
  -H "Authorization: Bearer $WIBLO_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{
  "name": "...",
  "email": "...",
  "role": "admin"
}'
```

**TypeScript**

```ts
import { createSdk, updateWorkspaceMember } from "@workspace/sdk"

const sdk = createSdk({ baseUrl: "https://api.wiblo.app" })

const { data, error } = await updateWorkspaceMember({
  client: sdk,
  path: { workspaceId: "...", memberId: "..." },
  body: {
    "name": "...",
    "email": "...",
    "role": "admin"
  },
})
```

## Responses

**`200`** — Member updated. Returns `MemberResponse`.

| Field | Type | Required | Description |
| --- | --- | --- | --- |
| `id` | `string` | Yes |  |
| `role` | `"owner" \| "admin" \| "member"` | Yes |  |
| `name` | `string` | Yes |  |
| `email` | `string \| null` | Yes |  |
| `avatar_url` | `string \| null` | Yes |  |
| `accent_hue` | `"red" \| "coral" \| "orange" \| "green" \| "teal" \| "blue" \| ...` | Yes | The member's stored monogram key; `null` means the tile derives its colour from the hash. Distinct from the user profile's accent_hue, which only seeds this at workspace creation. |
| `linked_user_id` | `string \| null` | Yes |  |
| `linked_at` | `string \| null` | Yes |  |
| `archived_at` | `string \| null` | Yes |  |
| `created_at` | `string` | Yes |  |
| `updated_at` | `string` | Yes |  |

**`400`** — Body failed Zod validation (`VALIDATION_FAILED`). Includes `role: 'owner'` (excluded from the union — ownership transfer is its own deferred endpoint). Returns `ApiErrorEnvelope`.

**`401`** — No valid Supabase session cookie was present. Returns `ApiErrorEnvelope`.

**`403`** — Trigger or RPC rejected the field-level write. Codes: `OWNER_REQUIRED` (admin attempted to grant/revoke `owner`, modify an owner row, or change link metadata) and `ADMIN_REQUIRED` (catch-all forbidden — e.g. self-edit-only profile rule on linked rows, member attempted to archive someone else, attempted self-unarchive). Returns `ApiErrorEnvelope`.

**`404`** — Caller has no active membership in the workspace (`WORKSPACE_NOT_FOUND`), the member does not exist in this workspace (`MEMBER_NOT_FOUND`), or the UPDATE was hidden by RLS (member acting on another linked member). Both 404 envelopes collapse cross-tenant existence leaks. Returns `ApiErrorEnvelope`.

**`409`** — Owner-floor invariant: archiving or demoting the last active owner of an active workspace (`LAST_OWNER`). Returns `ApiErrorEnvelope`.

**`422`** — Path param failed UUID validation (`INVALID_PARAMS`). Returns `ApiErrorEnvelope`.

**`429`** — Rate limit exceeded. The body's `error.code` is `RATE_LIMITED` and `error.details.retry_after` is the same number of seconds as the `Retry-After` header. Returns `ApiErrorEnvelope`.