Full replacement of user attributes (admin only)
PUT
/users/{userId}
Full replacement — all fields required. Updates a user's name, email, or admin status. Requires admin role. Prevents the last admin from demoting themselves. Sends a Slack notification when admin status changes (if Slack is configured). Returns both a toast and the updated user object.
Authorizations
tokenAuth
Personal access token authentication. Send via Authorization header: Authorization: Token vulcan_xxx. Tokens are SHA-256 hashed server-side (never stored in plaintext). Scopes: read (GET), write (mutations), admin (everything). Create tokens via Settings → API Tokens in the web UI.
Type
HTTP (token)
Request Body
application/json
JSON "user": { "admin": true }
{
}
Responses
User updated
application/json
JSON "toast": { "title": "User updated.", "message": [ "Successfully updated user." ], "variant": "success" }, "user": { "id": 42, "name": "Jane Doe", "email": "jane.doe@example.org", "admin": true }
{
}