Users

Update an existing user's information.

PUT

https://firefly.example.com/api/v1/users/{id}

Update existing user.

curl -X PUT 'https://firefly.example.com/api/v1/users/123' \
  -H 'X-Trace-Id: 40c71bbb-c676-4f24-83cf-cc725d7d7a00' \
  -H 'Authorization: Bearer YOUR_TOKEN' \
  -H 'Content-Type: application/json' \
  --data-raw '{
  "email": "james@firefly-iii.org",
  "blocked": false,
  "blocked_code": "email_changed",
  "role": "owner"
}'

const body = `{
  "email": "james@firefly-iii.org",
  "blocked": false,
  "blocked_code": "email_changed",
  "role": "owner"
}`;

const response = await fetch('https://firefly.example.com/api/v1/users/123', {
  method: 'PUT',
  headers: {
    'X-Trace-Id': '40c71bbb-c676-4f24-83cf-cc725d7d7a00',
    'Authorization': 'Bearer YOUR_TOKEN',
    'Content-Type': 'application/json',
  },
  body,
});

const data = await response.text();

import requests

body = '''{
  "email": "james@firefly-iii.org",
  "blocked": false,
  "blocked_code": "email_changed",
  "role": "owner"
}'''

response = requests.put(
    'https://firefly.example.com/api/v1/users/123',
    data=body.encode('utf-8'),
    headers={
        'X-Trace-Id': '40c71bbb-c676-4f24-83cf-cc725d7d7a00',
        'Authorization': 'Bearer YOUR_TOKEN',
        'Content-Type': 'application/json',
    },
)
print(response.text)

Request Body

{
  "email": "james@firefly-iii.org",
  "blocked": false,
  "blocked_code": "email_changed",
  "role": "owner"
}

{
  "email": "james@firefly-iii.org",
  "blocked": false,
  "blocked_code": "email_changed",
  "role": "owner"
}

{
  "data": {
    "type": "users",
    "id": "2",
    "attributes": {
      "created_at": "2026-10-01T00:00:00+00:00",
      "updated_at": "2026-10-01T00:00:00+00:00",
      "email": "james@firefly-iii.org",
      "blocked": false,
      "blocked_code": "email_changed",
      "role": "owner"
    },
    "links": {
      "0": {
        "rel": "self",
        "uri": "/OBJECTS/1"
      },
      "self": "https://demo.firefly-iii.org/api/v1/OBJECTS/1"
    }
  }
}

{
  "message": "Bad Request",
  "exception": "BadRequestHttpException"
}

{
  "message": "Unauthenticated",
  "exception": "AuthenticationException"
}

{
  "message": "Resource not found",
  "exception": "NotFoundHttpException"
}

{
  "message": "The given data was invalid.",
  "errors": {
    "email": [
      "string"
    ],
    "force": [
      "string"
    ],
    "blocked": [
      "string"
    ],
    "field": [
      "string"
    ],
    "role": [
      "string"
    ],
    "blocked_code": [
      "string"
    ],
    "name": [
      "string"
    ],
    "type": [
      "string"
    ],
    "iban": [
      "string"
    ],
    "start": [
      "string"
    ],
    "end": [
      "string"
    ],
    "date": [
      "string"
    ]
  }
}

{
  "message": "Internal Exception",
  "exception": "InternalException"
}

Body

JSON array with updated user information. See the model for the exact specifications.

application/json,application/x-www-form-urlencodedUser

emailstring<email>required

The new users email address.

Example

james@firefly-iii.org

blockedboolean

Boolean to indicate if the user is blocked.

Example

false

blocked_codeUserBlockedCodeProperty | nullemail_changednull

If you say the user must be blocked, this will be the reason code.

Example

email_changed

roleUserRoleProperty | nullownerdemonull

Role for the user. Can be empty or omitted.

Example

owner

Parameters

idstringrequiredpath

The user ID.

Response

200OKUserSingle

Updated user stored, result in response

Response fields application/vnd.api+json

dataUserReadrequired

Show child attributes

typestringrequired

Immutable value

Example

users

idstringrequired

Example

attributesUserrequired

Show child attributes

created_atstring<date-time>read only

Example

2026-10-01T00:00:00+00:00

updated_atstring<date-time>read only

Example

2026-10-01T00:00:00+00:00

emailstring<email>required

The new users email address.

Example

james@firefly-iii.org

blockedboolean

Boolean to indicate if the user is blocked.

Example

false

blocked_codeUserBlockedCodeProperty | nullemail_changednull

If you say the user must be blocked, this will be the reason code.

Example

email_changed

roleUserRoleProperty | nullownerdemonull

Role for the user. Can be empty or omitted.

Example

owner

linksObjectLinkrequired

Show child attributes

0object

Show child attributes

relstring

Example

self

uristring

Example

/OBJECTS/1

selfstring<uri>

Example

https://demo.firefly-iii.org/api/v1/OBJECTS/1

400Bad RequestBadRequestResponse

Bad request

Response fields application/json

messagestring

Example

Bad Request

exceptionstring

Example

BadRequestHttpException

401UnauthorizedUnauthenticatedResponse

Unauthenticated

Response fields application/json

messagestring

Example

Unauthenticated

exceptionstring

Example

AuthenticationException

404Not FoundNotFoundResponse

Page not found

Response fields application/json

messagestring

Example

Resource not found

exceptionstring

Example

NotFoundHttpException

422Unprocessable EntityValidationErrorResponse

Validation error. The body will have the exact details.

Response fields application/json

messagestring

Example

The given data was invalid.

errorsobject

Show child attributes

emailArray<string>

forceArray<string>

blockedArray<string>

fieldArray<string>

roleArray<string>

blocked_codeArray<string>

nameArray<string>

typeArray<string>

ibanArray<string>

startArray<string>

endArray<string>

dateArray<string>

500Internal Server ErrorInternalExceptionResponse

Internal exception

Response fields application/json

messagestring

Example

Internal Exception

exceptionstring

Example

InternalException

Authorization

firefly_iii_authoauth2

OAuth2 authorization code flow. Create a client on your installation's /profile page; it authorizes at /oauth/authorize and issues tokens at /oauth/token there. The URLs below are the demo site's. How to use the API walks through it.

local_bearer_authhttp (bearer)

A Personal Access Token, sent as a bearer token. Create one on your installation under Options > Profile > OAuth > Personal Access Tokens.