# Update an existing user's information.

`PUT /v1/users/{id}`

Update existing user.

Authentication (security requirement alternatives):

```json
[
  {
    "firefly_iii_auth": []
  },
  {
    "local_bearer_auth": []
  }
]
```

- firefly_iii_auth: oauth2. OAuth2 authorization code flow. Create a client on your installation's `/profile` page; it authorizes at `/oauth/authorize` and issues tokens at `/oauth/token` there. The URLs below are the demo site's. [How to use the API](https://sourcey-firefly.pages.dev/how-to/firefly-iii/features/api/index.md) walks through it.
- local_bearer_auth: http (bearer). A Personal Access Token, sent as a bearer token. Create one on your installation under Options > Profile > OAuth > Personal Access Tokens.

Parameters:

- `X-Trace-Id` (header, string, uuid, optional) - Unique identifier associated with this request.
  Type: string, uuid
  
  Example:
  
  ```json
  "40c71bbb-c676-4f24-83cf-cc725d7d7a00"
  ```

- `id` (path, string, required) - The user ID.
  Type: string
  
  Example:
  
  ```json
  "123"
  ```

Request body: application/json (required)

JSON array with updated user information. See the model for the exact specifications.

Type: object

Schema: [User](https://sourcey-firefly.pages.dev/api/models/user/index.md)

- `created_at` (optional)
  Type: string, date-time
  
  readOnly: true
  
  Example:
  
  ```json
  "2026-10-01T00:00:00+00:00"
  ```

- `updated_at` (optional)
  Type: string, date-time
  
  readOnly: true
  
  Example:
  
  ```json
  "2026-10-01T00:00:00+00:00"
  ```

- `email` (required)
  Type: string, email
  
  The new users email address.
  
  Example:
  
  ```json
  "james@firefly-iii.org"
  ```

- `blocked` (optional)
  Type: boolean
  
  Boolean to indicate if the user is blocked.
  
  Example:
  
  ```json
  false
  ```

- `blocked_code` (optional)
  Reference: [UserBlockedCodeProperty](https://sourcey-firefly.pages.dev/api/models/userblockedcodeproperty/index.md); Type: string, string; nullable
  
  If you say the user must be blocked, this will be the reason code.
  
  enum: ["email_changed",null]
  
  Example:
  
  ```json
  "email_changed"
  ```

- `role` (optional)
  Reference: [UserRoleProperty](https://sourcey-firefly.pages.dev/api/models/userroleproperty/index.md); Type: string, string; nullable
  
  Role for the user. Can be empty or omitted.
  
  enum: ["owner","demo",null]
  
  Example:
  
  ```json
  "owner"
  ```

Request body: application/x-www-form-urlencoded (required)

JSON array with updated user information. See the model for the exact specifications.

Type: object

Schema: [User](https://sourcey-firefly.pages.dev/api/models/user/index.md)

- `created_at` (optional)
  Type: string, date-time
  
  readOnly: true
  
  Example:
  
  ```json
  "2026-10-01T00:00:00+00:00"
  ```

- `updated_at` (optional)
  Type: string, date-time
  
  readOnly: true
  
  Example:
  
  ```json
  "2026-10-01T00:00:00+00:00"
  ```

- `email` (required)
  Type: string, email
  
  The new users email address.
  
  Example:
  
  ```json
  "james@firefly-iii.org"
  ```

- `blocked` (optional)
  Type: boolean
  
  Boolean to indicate if the user is blocked.
  
  Example:
  
  ```json
  false
  ```

- `blocked_code` (optional)
  Reference: [UserBlockedCodeProperty](https://sourcey-firefly.pages.dev/api/models/userblockedcodeproperty/index.md); Type: string, string; nullable
  
  If you say the user must be blocked, this will be the reason code.
  
  enum: ["email_changed",null]
  
  Example:
  
  ```json
  "email_changed"
  ```

- `role` (optional)
  Reference: [UserRoleProperty](https://sourcey-firefly.pages.dev/api/models/userroleproperty/index.md); Type: string, string; nullable
  
  Role for the user. Can be empty or omitted.
  
  enum: ["owner","demo",null]
  
  Example:
  
  ```json
  "owner"
  ```

Responses:

- 200: Updated user stored, result in response

Content type: application/vnd.api+json

Type: object

Schema: [UserSingle](https://sourcey-firefly.pages.dev/api/models/usersingle/index.md)

- `data` (required)
  Reference: [UserRead](https://sourcey-firefly.pages.dev/api/models/userread/index.md); Type: object

- 400: Bad request

Content type: application/json

Type: object

Schema: [BadRequestResponse](https://sourcey-firefly.pages.dev/api/models/badrequestresponse/index.md)

- `message` (optional)
  Type: string, string
  
  Example:
  
  ```json
  "Bad Request"
  ```

- `exception` (optional)
  Type: string, string
  
  Example:
  
  ```json
  "BadRequestHttpException"
  ```

- 401: Unauthenticated

Content type: application/json

Type: object

Schema: [UnauthenticatedResponse](https://sourcey-firefly.pages.dev/api/models/unauthenticatedresponse/index.md)

- `message` (optional)
  Type: string, string
  
  Example:
  
  ```json
  "Unauthenticated"
  ```

- `exception` (optional)
  Type: string, string
  
  Example:
  
  ```json
  "AuthenticationException"
  ```

- 404: Page not found

Content type: application/json

Type: object

Schema: [NotFoundResponse](https://sourcey-firefly.pages.dev/api/models/notfoundresponse/index.md)

- `message` (optional)
  Type: string, string
  
  Example:
  
  ```json
  "Resource not found"
  ```

- `exception` (optional)
  Type: string, string
  
  Example:
  
  ```json
  "NotFoundHttpException"
  ```

- 422: Validation error. The body will have the exact details.

Content type: application/json

Type: object

Schema: [ValidationErrorResponse](https://sourcey-firefly.pages.dev/api/models/validationerrorresponse/index.md)

- `message` (optional)
  Type: string, string
  
  Example:
  
  ```json
  "The given data was invalid."
  ```

- `errors` (optional)
  Type: object
  
  - `email` (optional)
    Type: array
    
    Items:
      Type: string, string
  
  - `force` (optional)
    Type: array
    
    Items:
      Type: string, string
  
  - `blocked` (optional)
    Type: array
    
    Items:
      Type: string, string
  
  - `field` (optional)
    Type: array
    
    Items:
      Type: string, string
  
  - `role` (optional)
    Type: array
    
    Items:
      Type: string, string
  
  - `blocked_code` (optional)
    Type: array
    
    Items:
      Type: string, string
  
  - `name` (optional)
    Type: array
    
    Items:
      Type: string, string
  
  - `type` (optional)
    Type: array
    
    Items:
      Type: string, string
  
  - `iban` (optional)
    Type: array
    
    Items:
      Type: string, string
  
  - `start` (optional)
    Type: array
    
    Items:
      Type: string, string
  
  - `end` (optional)
    Type: array
    
    Items:
      Type: string, string
  
  - `date` (optional)
    Type: array
    
    Items:
      Type: string, string

- 500: Internal exception

Content type: application/json

Type: object

Schema: [InternalExceptionResponse](https://sourcey-firefly.pages.dev/api/models/internalexceptionresponse/index.md)

- `message` (optional)
  Type: string, string
  
  Example:
  
  ```json
  "Internal Exception"
  ```

- `exception` (optional)
  Type: string, string
  
  Example:
  
  ```json
  "InternalException"
  ```

## Examples

### cURL

```bash
curl -X PUT 'https://firefly.example.com/api/v1/users/123' \
  -H 'X-Trace-Id: 40c71bbb-c676-4f24-83cf-cc725d7d7a00' \
  -H 'Authorization: Bearer YOUR_TOKEN' \
  -H 'Content-Type: application/json' \
  --data-raw '{
  "email": "james@firefly-iii.org",
  "blocked": false,
  "blocked_code": "email_changed",
  "role": "owner"
}'
```

### JavaScript

```javascript
const body = `{
  "email": "james@firefly-iii.org",
  "blocked": false,
  "blocked_code": "email_changed",
  "role": "owner"
}`;

const response = await fetch('https://firefly.example.com/api/v1/users/123', {
  method: 'PUT',
  headers: {
    'X-Trace-Id': '40c71bbb-c676-4f24-83cf-cc725d7d7a00',
    'Authorization': 'Bearer YOUR_TOKEN',
    'Content-Type': 'application/json',
  },
  body,
});

const data = await response.text();
```

### Python

```python
import requests

body = '''{
  "email": "james@firefly-iii.org",
  "blocked": false,
  "blocked_code": "email_changed",
  "role": "owner"
}'''

response = requests.put(
    'https://firefly.example.com/api/v1/users/123',
    data=body.encode('utf-8'),
    headers={
        'X-Trace-Id': '40c71bbb-c676-4f24-83cf-cc725d7d7a00',
        'Authorization': 'Bearer YOUR_TOKEN',
        'Content-Type': 'application/json',
    },
)
print(response.text)
```