Update User

Partially updates a user's data for the authenticated company. Only the fields included in the request body are updated; omitted fields remain unchanged.

Rules:

name and roleId can only be updated for active users.
The user's email cannot be changed.
Users with the MAIN profile cannot be updated.
The last administrator (RESPONSIBLE) of the account cannot be demoted.
Returns 404 if the user does not belong to the authenticated company.

curl -X PATCH "https://api-sandbox.contasimples.com/users/v1/users/550e8400-e29b-41d4-a716-446655440000" \
  -H "Content-Type: application/json" \
  -H "Signature-Input: example_string" \
  -H "Signature: example_string" \
  -H "Content-Digest: example_string" \
  -H "Authorization: Bearer YOUR_API_TOKEN" \
  -d '{
  "name": "John Smith",
  "roleId": "8a3f1b2c-4e5d-6f7a-8b9c-0d1e2f3a4b5c"
}'

import requests
import json

url = "https://api-sandbox.contasimples.com/users/v1/users/550e8400-e29b-41d4-a716-446655440000"
headers = {
  "Content-Type": "application/json",
  "Signature-Input": "example_string",
  "Signature": "example_string",
  "Content-Digest": "example_string",
  "Authorization": "Bearer YOUR_API_TOKEN"
}
data = {
  "name": "John Smith",
  "roleId": "8a3f1b2c-4e5d-6f7a-8b9c-0d1e2f3a4b5c"
}

response = requests.patch(url, headers=headers, json=data)
print(response.json())

const response = await fetch("https://api-sandbox.contasimples.com/users/v1/users/550e8400-e29b-41d4-a716-446655440000", {
  method: "PATCH",
  headers: {
  "Content-Type": "application/json",
  "Signature-Input": "example_string",
  "Signature": "example_string",
  "Content-Digest": "example_string",
  "Authorization": "Bearer YOUR_API_TOKEN"
},
  body: JSON.stringify({
  "name": "John Smith",
  "roleId": "8a3f1b2c-4e5d-6f7a-8b9c-0d1e2f3a4b5c"
})
});

const data = await response.json();
console.log(data);

package main

import (
    "fmt"
    "net/http"
    "bytes"
    "encoding/json"
)

func main() {
    data := []byte(`{
  "name": "John Smith",
  "roleId": "8a3f1b2c-4e5d-6f7a-8b9c-0d1e2f3a4b5c"
}`)

    req, err := http.NewRequest("PATCH", "https://api-sandbox.contasimples.com/users/v1/users/550e8400-e29b-41d4-a716-446655440000", bytes.NewBuffer(data))
    if err != nil {
        panic(err)
    }

    req.Header.Set("Content-Type", "application/json")
    req.Header.Set("Signature-Input", "example_string")
    req.Header.Set("Signature", "example_string")
    req.Header.Set("Content-Digest", "example_string")
    req.Header.Set("Authorization", "Bearer YOUR_API_TOKEN")

    client := &http.Client{}
    resp, err := client.Do(req)
    if err != nil {
        panic(err)
    }
    defer resp.Body.Close()

    fmt.Println("Response Status:", resp.Status)
}

require 'net/http'
require 'json'

uri = URI('https://api-sandbox.contasimples.com/users/v1/users/550e8400-e29b-41d4-a716-446655440000')
http = Net::HTTP.new(uri.host, uri.port)
http.use_ssl = true

request = Net::HTTP::Patch.new(uri)
request['Content-Type'] = 'application/json'
request['Signature-Input'] = 'example_string'
request['Signature'] = 'example_string'
request['Content-Digest'] = 'example_string'
request['Authorization'] = 'Bearer YOUR_API_TOKEN'
request.body = '{
  "name": "John Smith",
  "roleId": "8a3f1b2c-4e5d-6f7a-8b9c-0d1e2f3a4b5c"
}'

response = http.request(request)
puts response.body

{
  "id": "550e8400-e29b-41d4-a716-446655440000",
  "email": "joao.silva@empresa.com.br",
  "name": "John Smith",
  "phone": "11999999999",
  "role": {
    "id": "8a3f1b2c-4e5d-6f7a-8b9c-0d1e2f3a4b5c",
    "name": "Accountant"
  },
  "active": true
}

{
  "error": "Bad Request",
  "message": "The request contains invalid parameters or malformed data",
  "code": 400,
  "details": [
    {
      "field": "email",
      "message": "Invalid email format"
    }
  ]
}

PATCH

/users/v1/users/{userId}

PATCH

Base URLstring

Target server for requests. Edit to use your own host.

Bearer Token

Bearer Tokenstring

Required

Bearer token from OAuth 2.0 client credentials. Format: Bearer TOKEN

path

userIdstring

Required

User ID (UUID v4) — use the id field value returned by GET /users/v1/users (e.g., 550e8400-e29b-41d4-a716-446655440000).

Format: uuid

Content-Typestring

Required

The media type of the request body

Options: application/json

header

Signature-Inputstring

What was signed and the signature parameters, in the RFC 9421 format. A credential with a public key must send it on every call, reads included, or the request is refused with 401. The signature covers the @method, @path, and @query components, and also content-digest when there is a body. created and alg are required, and created is valid for 300 seconds. The full format, with examples, is in Request Signing.

header

Signaturestring

The signature of the base defined by RFC 9421, in base64, between : and under the same label used in Signature-Input, for example sig=:SGVsbG8gd29ybGQ=:. It always goes together with Signature-Input.

header

Content-Digeststring

Hash of the request body in the RFC 9530 format, with sha-256 or sha-512, for example sha-256=:X48E9qOokqqrvdts8nOJRJN3OWDUoyWxBf7kbu9DBPE=:. It is required when the request has a body and the credential has a public key, and in that case Signature-Input must include the content-digest component.