Update user
Changes a user of the given organization and returns it as the list returns it. Only the properties in the body are changed: a property that is left out keeps its value, and null clears an optional property. A user read from the list can be sent back, changed or not; leave out language when it is null.
email and ssn can’t be changed: the email address is the user’s login and the identity number identifies the person. They are accepted when they equal the user’s current values, otherwise the request is rejected. The read-only id, lastInvitationDate and dateCreated are ignored.
The values get the same checks as when a user is created: unknown departments, dimensions, dimension values and languages, invalid bank account numbers, IBAN and BIC values, and an endDate in the past are rejected instead of ignored. An endDate, bankAccountNumber, IBAN or BIC sent back unchanged isn’t checked again; the other values, such as department and customDimensionPresetValues, are checked even when unchanged. No other user of the organization may have the same externalSourceId or employeeId.
firstName, lastName, mobilePhone, language, bankAccountNumber, IBAN and BIC belong to the person behind the user, which every organization employing that person shares. While the person is also a (not deleted) user of another organization, these can’t be changed, so one organization can’t change another’s data or redirect its reimbursements: they are accepted when they equal the current values, otherwise the request is rejected with 400 and code INVALID_JSON_PROPERTY_VALUE, and nothing is changed. Bank details count as unchanged when they only differ in formatting, such as spaces or dashes. The properties of the employment itself, such as employeeId, department and isAdministrator, can still be changed.
Making a user an administrator also gives them the organization administrator role. A changed department only changes the user’s department; reports already sent for approval keep their approvers.
Returns 403 when the organization does not exist or the authenticated user is not an administrator of it, so a caller cannot tell an organization they lack access to from a missing one. Also returns 403 when the organization has no user with the given ID, including a user that is deleted.
curl --request PUT \
--url https://stage-api.findity.com/api/v1/admin/organizations/{organizationId}/users/{userId} \
--header 'Authorization: Bearer <token>' \
--header 'Content-Type: application/json' \
--data '
{
"title": "Senior Engineering Lead",
"mobilePhone": "+46701740605",
"department": {
"externalSourceId": "SAP-4711"
},
"customDimensionPresetValues": [
{
"dimensionDefinitionId": "a1b2c3d4e5f60718293a4b5c6d7e8f90",
"presetListValueId": "c0ffee00c0ffee00c0ffee00c0ffee00"
}
],
"endDate": null,
"isAdministrator": true
}
'import requests
url = "https://stage-api.findity.com/api/v1/admin/organizations/{organizationId}/users/{userId}"
payload = {
"title": "Senior Engineering Lead",
"mobilePhone": "+46701740605",
"department": { "externalSourceId": "SAP-4711" },
"customDimensionPresetValues": [
{
"dimensionDefinitionId": "a1b2c3d4e5f60718293a4b5c6d7e8f90",
"presetListValueId": "c0ffee00c0ffee00c0ffee00c0ffee00"
}
],
"endDate": None,
"isAdministrator": True
}
headers = {
"Authorization": "Bearer <token>",
"Content-Type": "application/json"
}
response = requests.put(url, json=payload, headers=headers)
print(response.text)const options = {
method: 'PUT',
headers: {Authorization: 'Bearer <token>', 'Content-Type': 'application/json'},
body: JSON.stringify({
title: 'Senior Engineering Lead',
mobilePhone: '+46701740605',
department: {externalSourceId: 'SAP-4711'},
customDimensionPresetValues: [
{
dimensionDefinitionId: 'a1b2c3d4e5f60718293a4b5c6d7e8f90',
presetListValueId: 'c0ffee00c0ffee00c0ffee00c0ffee00'
}
],
endDate: null,
isAdministrator: true
})
};
fetch('https://stage-api.findity.com/api/v1/admin/organizations/{organizationId}/users/{userId}', options)
.then(res => res.json())
.then(res => console.log(res))
.catch(err => console.error(err));<?php
$curl = curl_init();
curl_setopt_array($curl, [
CURLOPT_URL => "https://stage-api.findity.com/api/v1/admin/organizations/{organizationId}/users/{userId}",
CURLOPT_RETURNTRANSFER => true,
CURLOPT_ENCODING => "",
CURLOPT_MAXREDIRS => 10,
CURLOPT_TIMEOUT => 30,
CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
CURLOPT_CUSTOMREQUEST => "PUT",
CURLOPT_POSTFIELDS => json_encode([
'title' => 'Senior Engineering Lead',
'mobilePhone' => '+46701740605',
'department' => [
'externalSourceId' => 'SAP-4711'
],
'customDimensionPresetValues' => [
[
'dimensionDefinitionId' => 'a1b2c3d4e5f60718293a4b5c6d7e8f90',
'presetListValueId' => 'c0ffee00c0ffee00c0ffee00c0ffee00'
]
],
'endDate' => null,
'isAdministrator' => true
]),
CURLOPT_HTTPHEADER => [
"Authorization: Bearer <token>",
"Content-Type: application/json"
],
]);
$response = curl_exec($curl);
$err = curl_error($curl);
curl_close($curl);
if ($err) {
echo "cURL Error #:" . $err;
} else {
echo $response;
}package main
import (
"fmt"
"strings"
"net/http"
"io"
)
func main() {
url := "https://stage-api.findity.com/api/v1/admin/organizations/{organizationId}/users/{userId}"
payload := strings.NewReader("{\n \"title\": \"Senior Engineering Lead\",\n \"mobilePhone\": \"+46701740605\",\n \"department\": {\n \"externalSourceId\": \"SAP-4711\"\n },\n \"customDimensionPresetValues\": [\n {\n \"dimensionDefinitionId\": \"a1b2c3d4e5f60718293a4b5c6d7e8f90\",\n \"presetListValueId\": \"c0ffee00c0ffee00c0ffee00c0ffee00\"\n }\n ],\n \"endDate\": null,\n \"isAdministrator\": true\n}")
req, _ := http.NewRequest("PUT", url, payload)
req.Header.Add("Authorization", "Bearer <token>")
req.Header.Add("Content-Type", "application/json")
res, _ := http.DefaultClient.Do(req)
defer res.Body.Close()
body, _ := io.ReadAll(res.Body)
fmt.Println(string(body))
}HttpResponse<String> response = Unirest.put("https://stage-api.findity.com/api/v1/admin/organizations/{organizationId}/users/{userId}")
.header("Authorization", "Bearer <token>")
.header("Content-Type", "application/json")
.body("{\n \"title\": \"Senior Engineering Lead\",\n \"mobilePhone\": \"+46701740605\",\n \"department\": {\n \"externalSourceId\": \"SAP-4711\"\n },\n \"customDimensionPresetValues\": [\n {\n \"dimensionDefinitionId\": \"a1b2c3d4e5f60718293a4b5c6d7e8f90\",\n \"presetListValueId\": \"c0ffee00c0ffee00c0ffee00c0ffee00\"\n }\n ],\n \"endDate\": null,\n \"isAdministrator\": true\n}")
.asString();require 'uri'
require 'net/http'
url = URI("https://stage-api.findity.com/api/v1/admin/organizations/{organizationId}/users/{userId}")
http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true
request = Net::HTTP::Put.new(url)
request["Authorization"] = 'Bearer <token>'
request["Content-Type"] = 'application/json'
request.body = "{\n \"title\": \"Senior Engineering Lead\",\n \"mobilePhone\": \"+46701740605\",\n \"department\": {\n \"externalSourceId\": \"SAP-4711\"\n },\n \"customDimensionPresetValues\": [\n {\n \"dimensionDefinitionId\": \"a1b2c3d4e5f60718293a4b5c6d7e8f90\",\n \"presetListValueId\": \"c0ffee00c0ffee00c0ffee00c0ffee00\"\n }\n ],\n \"endDate\": null,\n \"isAdministrator\": true\n}"
response = http.request(request)
puts response.read_body{
"id": "8a66aa549e6a3672019e73b79f8e1a7f",
"externalSourceId": "Erik_Exempel",
"employeeId": "E-1001",
"title": "Engineering Lead",
"firstName": "Erik",
"lastName": "Exempel",
"email": "erik.exempel@example.com",
"mobilePhone": "+46701740605",
"endDate": "2027-01-31T00:00:00Z",
"ssn": "1212121212",
"department": {
"id": "9360d03ad7294220868d67f42a2a144d",
"externalSourceId": null
},
"customDimensionPresetValues": [
{
"id": "5d1e2f3a4b5c6d7e8f9a0b1c2d3e4f5a",
"dimensionDefinitionId": "c2a0b3f4d5e64f7a8b9c0d1e2f3a4b5c",
"presetListValueId": null,
"presetListValueText": null,
"presetStringValue": "Project X"
}
],
"language": "en_GB",
"bankAccountNumber": "95621537876",
"IBAN": "SE4550000000058398257466",
"BIC": "ESSESESS",
"lastInvitationDate": null,
"dateCreated": "2026-10-13T12:31:14Z",
"isAdministrator": false
}Authorizations
Bearer authentication header of the form Bearer <token>, where <token> is your auth token.
Path Parameters
Required. String. Identifies the organization of the user. Accepts either the organization's internal ID (32-character hexadecimal string) or its externalSourceId (the string an integration set on the organization). This endpoint supports externalId: when the value has the format of an internal ID and an organization with that ID exists, the internal ID takes precedence; otherwise the value is looked up as externalSourceId.
Required. String. Identifies the user to update, as returned in the id or externalSourceId field of the list response: either the user's internal ID (32-character hexadecimal string) or its externalSourceId (the non-empty string an integration set on the user). Only the users of the given organization are searched. This endpoint supports externalId: when a user of the organization has that internal ID, the internal ID takes precedence; otherwise the value is looked up as externalSourceId.
Body
The properties of a user to change. Only the properties in the body are changed; a property that is left out keeps its value, and null clears an optional property. The properties have the same names and formats as in the list response, so a listed user can be sent back: email and ssn are accepted when they equal the user's current values, and the read-only properties id, lastInvitationDate and dateCreated are ignored. Leave out language when the list returns null for it, since null is rejected. email, firstName, lastName, externalSourceId, employeeId, title, mobilePhone and bankAccountNumber can be at most 255 characters long after leading and trailing whitespace is removed, and a text dimension's presetStringValue at most 255 characters; a longer value is rejected with 400 FIELD_EXCEEDS_MAX_LENGTH and nothing is changed. The limit is checked on every value in the body, also on one sent back unchanged; a value the list returns always fits, since the stored values are at most 255 characters. Apart from that length check, an endDate, bankAccountNumber, IBAN or BIC sent back unchanged isn't validated again; the other values, such as department and customDimensionPresetValues, are validated even when unchanged. firstName, lastName, mobilePhone, language, bankAccountNumber, IBAN and BIC belong to the person, whom every organization employing them shares: while the person is also a (not deleted) user of another organization, they are accepted only when they equal the current values, otherwise the request is rejected with 400 INVALID_JSON_PROPERTY_VALUE and nothing is changed. Bank details that only differ in formatting, such as spaces or dashes, count as unchanged.
Can't be changed. String. The user's email address, which is also their login. Accepted only when it is the user's current email address (case-insensitive), otherwise 400 INVALID_JSON_PROPERTY_VALUE. At most 255 characters after leading and trailing whitespace is removed, otherwise 400 FIELD_EXCEEDS_MAX_LENGTH.
255Can't be changed. String. The user's personal identity number. Accepted only when it is the user's current number, written in any accepted format (19121212-1212 matches a stored 1212121212), otherwise 400 INVALID_JSON_PROPERTY_VALUE.
Optional. String. The user's first name. Can't be empty or null. Can't be changed while the person is also a user of another organization: then accepted only when equal to the current value, otherwise 400 INVALID_JSON_PROPERTY_VALUE. At most 255 characters after leading and trailing whitespace is removed, otherwise 400 FIELD_EXCEEDS_MAX_LENGTH.
255Optional. String. The user's last name. Can't be empty or null. Can't be changed while the person is also a user of another organization: then accepted only when equal to the current value, otherwise 400 INVALID_JSON_PROPERTY_VALUE. At most 255 characters after leading and trailing whitespace is removed, otherwise 400 FIELD_EXCEEDS_MAX_LENGTH.
255Optional. String. Identifier of the user in an external system. No other user of the organization may have it. null clears it. At most 255 characters after leading and trailing whitespace is removed, otherwise 400 FIELD_EXCEEDS_MAX_LENGTH.
255Optional. String. The user's employee number in the organization. No other user of the organization may have it. null clears it. At most 255 characters after leading and trailing whitespace is removed, otherwise 400 FIELD_EXCEEDS_MAX_LENGTH.
255Optional. String. The user's job title. null clears it. At most 255 characters after leading and trailing whitespace is removed, otherwise 400 FIELD_EXCEEDS_MAX_LENGTH.
255Optional. String. The user's mobile phone number in international format (e.g. +46701234567). null clears it. A user whose mobile number is verified keeps that number: a different number or null is ignored, and the request still answers 200. Can't be changed while the person is also a user of another organization: then accepted only when equal to the current value, otherwise 400 INVALID_JSON_PROPERTY_VALUE. At most 255 characters after leading and trailing whitespace is removed, otherwise 400 FIELD_EXCEEDS_MAX_LENGTH.
255Optional. ISO-8601 date-time in UTC (yyyy-MM-ddTHH:mm:ssZ). The date the user's employment ends. A new value can't be in the past. null clears it.
Optional. The department (organizational unit) of the organization to place the user in, identified by either id or externalSourceId; at least one of them is required. When both are given, id is used. null removes the user from their department.
Optional. Custom dimension values to preset on the user, used as defaults on the user's expenses. The list replaces the user's preset values: a dimension left out of it loses its preset value, and null or [] removes them all. The other properties of a listed preset value are ignored.
Hide child attributes
Hide child attributes
Required. String. The ID of a custom dimension definition of the organization.
String. Required for a dimension with a list of values, the ID of one of the list's values.
String. For a text dimension, the preset text. At most 255 characters, counted as sent; a longer value is rejected with 400 FIELD_EXCEEDS_MAX_LENGTH.
255Optional. String. The user's language and region as a locale code (language_COUNTRY, e.g. en_GB, sv_SE). Can't be null: leave it out for a user the list returns with language: null. Can't be changed while the person is also a user of another organization: then accepted only when equal to the current value, otherwise 400 INVALID_JSON_PROPERTY_VALUE.
Optional. String. The user's bank account number for reimbursements, validated for the organization's country unless the client application turns that validation off. Stored without separators. null clears it. Can't be changed while the person is also a user of another organization: then accepted only when equal to the current value (ignoring formatting), otherwise 400 INVALID_JSON_PROPERTY_VALUE. At most 255 characters after leading and trailing whitespace is removed, otherwise 400 FIELD_EXCEEDS_MAX_LENGTH.
255Optional. String. The user's International Bank Account Number for reimbursements. Spaces are allowed and removed; stored in upper case. null clears it. Can't be changed while the person is also a user of another organization: then accepted only when equal to the current value (ignoring formatting), otherwise 400 INVALID_JSON_PROPERTY_VALUE.
Optional. String. The Bank Identifier Code (SWIFT code) of the user's bank. Spaces are allowed and removed; stored in upper case. null clears it. Can't be changed while the person is also a user of another organization: then accepted only when equal to the current value (ignoring formatting), otherwise 400 INVALID_JSON_PROPERTY_VALUE.
Optional. Boolean. True makes the user an administrator of the organization, false removes them as one. null leaves it unchanged.
Response
OK — the updated user
A user of an organization: a person employed by the organization. Every property is always present; properties without a value are null.
UUID without dashes (32-character hex string)
^[0-9a-fA-F]{32}$String. Identifier of the user in an external system, set by an integration. Unique within the client application. Null when not set.
String. The user's employee number in the organization. Null when not set.
String. The user's job title. Null when not set.
String. The user's first name.
String. The user's last name.
String. The user's email address, also used to log in.
String. The user's mobile phone number as entered, usually in international format (e.g. +46701234567). Null when not set.
ISO-8601 date-time in UTC (yyyy-MM-ddTHH:mm:ssZ). The date the user's employment ends. Null when the employment has no end date.
String. The user's personal identity number (social security number), as stored. A number entered by the user is stored normalized, for Swedish numbers without separator and century digits (e.g. 1212121212). Null when not set.
The department (organizational unit) the user belongs to. Null when the user is not placed in a department.
Custom dimension values preset on the user, used as defaults on the user's expenses. Excludes values belonging to deleted dimension definitions. Empty when none are set.
Hide child attributes
Hide child attributes
Unique identifier of the preset value.
The ID of the custom dimension definition this preset value belongs to.
The ID of the selected list value, when the dimension uses a list of values. Null when a free-text preset is used instead.
Display text of the selected list value. Null when a free-text preset is used instead.
Free-text preset value, when the dimension does not use a list of values. Null when a list value is used instead.
String. The user's language and region as a locale code (language_COUNTRY, e.g. en_GB, sv_SE). Null when the user has not chosen a language, in which case the organization's language applies.
String. The user's bank account number for reimbursements. Null when not set.
String. The user's International Bank Account Number for reimbursements. Null when not set.
String. The Bank Identifier Code (SWIFT code) of the user's bank. Null when not set.
ISO-8601 date-time in UTC (yyyy-MM-ddTHH:mm:ssZ). When the user was last sent an invitation email. Null when the user has not been invited, or has since activated their account.
ISO-8601 date-time in UTC (yyyy-MM-ddTHH:mm:ssZ). When the user was added to the organization.
Boolean. True when the user is an administrator of the organization.
curl --request PUT \
--url https://stage-api.findity.com/api/v1/admin/organizations/{organizationId}/users/{userId} \
--header 'Authorization: Bearer <token>' \
--header 'Content-Type: application/json' \
--data '
{
"title": "Senior Engineering Lead",
"mobilePhone": "+46701740605",
"department": {
"externalSourceId": "SAP-4711"
},
"customDimensionPresetValues": [
{
"dimensionDefinitionId": "a1b2c3d4e5f60718293a4b5c6d7e8f90",
"presetListValueId": "c0ffee00c0ffee00c0ffee00c0ffee00"
}
],
"endDate": null,
"isAdministrator": true
}
'import requests
url = "https://stage-api.findity.com/api/v1/admin/organizations/{organizationId}/users/{userId}"
payload = {
"title": "Senior Engineering Lead",
"mobilePhone": "+46701740605",
"department": { "externalSourceId": "SAP-4711" },
"customDimensionPresetValues": [
{
"dimensionDefinitionId": "a1b2c3d4e5f60718293a4b5c6d7e8f90",
"presetListValueId": "c0ffee00c0ffee00c0ffee00c0ffee00"
}
],
"endDate": None,
"isAdministrator": True
}
headers = {
"Authorization": "Bearer <token>",
"Content-Type": "application/json"
}
response = requests.put(url, json=payload, headers=headers)
print(response.text)const options = {
method: 'PUT',
headers: {Authorization: 'Bearer <token>', 'Content-Type': 'application/json'},
body: JSON.stringify({
title: 'Senior Engineering Lead',
mobilePhone: '+46701740605',
department: {externalSourceId: 'SAP-4711'},
customDimensionPresetValues: [
{
dimensionDefinitionId: 'a1b2c3d4e5f60718293a4b5c6d7e8f90',
presetListValueId: 'c0ffee00c0ffee00c0ffee00c0ffee00'
}
],
endDate: null,
isAdministrator: true
})
};
fetch('https://stage-api.findity.com/api/v1/admin/organizations/{organizationId}/users/{userId}', options)
.then(res => res.json())
.then(res => console.log(res))
.catch(err => console.error(err));<?php
$curl = curl_init();
curl_setopt_array($curl, [
CURLOPT_URL => "https://stage-api.findity.com/api/v1/admin/organizations/{organizationId}/users/{userId}",
CURLOPT_RETURNTRANSFER => true,
CURLOPT_ENCODING => "",
CURLOPT_MAXREDIRS => 10,
CURLOPT_TIMEOUT => 30,
CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
CURLOPT_CUSTOMREQUEST => "PUT",
CURLOPT_POSTFIELDS => json_encode([
'title' => 'Senior Engineering Lead',
'mobilePhone' => '+46701740605',
'department' => [
'externalSourceId' => 'SAP-4711'
],
'customDimensionPresetValues' => [
[
'dimensionDefinitionId' => 'a1b2c3d4e5f60718293a4b5c6d7e8f90',
'presetListValueId' => 'c0ffee00c0ffee00c0ffee00c0ffee00'
]
],
'endDate' => null,
'isAdministrator' => true
]),
CURLOPT_HTTPHEADER => [
"Authorization: Bearer <token>",
"Content-Type: application/json"
],
]);
$response = curl_exec($curl);
$err = curl_error($curl);
curl_close($curl);
if ($err) {
echo "cURL Error #:" . $err;
} else {
echo $response;
}package main
import (
"fmt"
"strings"
"net/http"
"io"
)
func main() {
url := "https://stage-api.findity.com/api/v1/admin/organizations/{organizationId}/users/{userId}"
payload := strings.NewReader("{\n \"title\": \"Senior Engineering Lead\",\n \"mobilePhone\": \"+46701740605\",\n \"department\": {\n \"externalSourceId\": \"SAP-4711\"\n },\n \"customDimensionPresetValues\": [\n {\n \"dimensionDefinitionId\": \"a1b2c3d4e5f60718293a4b5c6d7e8f90\",\n \"presetListValueId\": \"c0ffee00c0ffee00c0ffee00c0ffee00\"\n }\n ],\n \"endDate\": null,\n \"isAdministrator\": true\n}")
req, _ := http.NewRequest("PUT", url, payload)
req.Header.Add("Authorization", "Bearer <token>")
req.Header.Add("Content-Type", "application/json")
res, _ := http.DefaultClient.Do(req)
defer res.Body.Close()
body, _ := io.ReadAll(res.Body)
fmt.Println(string(body))
}HttpResponse<String> response = Unirest.put("https://stage-api.findity.com/api/v1/admin/organizations/{organizationId}/users/{userId}")
.header("Authorization", "Bearer <token>")
.header("Content-Type", "application/json")
.body("{\n \"title\": \"Senior Engineering Lead\",\n \"mobilePhone\": \"+46701740605\",\n \"department\": {\n \"externalSourceId\": \"SAP-4711\"\n },\n \"customDimensionPresetValues\": [\n {\n \"dimensionDefinitionId\": \"a1b2c3d4e5f60718293a4b5c6d7e8f90\",\n \"presetListValueId\": \"c0ffee00c0ffee00c0ffee00c0ffee00\"\n }\n ],\n \"endDate\": null,\n \"isAdministrator\": true\n}")
.asString();require 'uri'
require 'net/http'
url = URI("https://stage-api.findity.com/api/v1/admin/organizations/{organizationId}/users/{userId}")
http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true
request = Net::HTTP::Put.new(url)
request["Authorization"] = 'Bearer <token>'
request["Content-Type"] = 'application/json'
request.body = "{\n \"title\": \"Senior Engineering Lead\",\n \"mobilePhone\": \"+46701740605\",\n \"department\": {\n \"externalSourceId\": \"SAP-4711\"\n },\n \"customDimensionPresetValues\": [\n {\n \"dimensionDefinitionId\": \"a1b2c3d4e5f60718293a4b5c6d7e8f90\",\n \"presetListValueId\": \"c0ffee00c0ffee00c0ffee00c0ffee00\"\n }\n ],\n \"endDate\": null,\n \"isAdministrator\": true\n}"
response = http.request(request)
puts response.read_body{
"id": "8a66aa549e6a3672019e73b79f8e1a7f",
"externalSourceId": "Erik_Exempel",
"employeeId": "E-1001",
"title": "Engineering Lead",
"firstName": "Erik",
"lastName": "Exempel",
"email": "erik.exempel@example.com",
"mobilePhone": "+46701740605",
"endDate": "2027-01-31T00:00:00Z",
"ssn": "1212121212",
"department": {
"id": "9360d03ad7294220868d67f42a2a144d",
"externalSourceId": null
},
"customDimensionPresetValues": [
{
"id": "5d1e2f3a4b5c6d7e8f9a0b1c2d3e4f5a",
"dimensionDefinitionId": "c2a0b3f4d5e64f7a8b9c0d1e2f3a4b5c",
"presetListValueId": null,
"presetListValueText": null,
"presetStringValue": "Project X"
}
],
"language": "en_GB",
"bankAccountNumber": "95621537876",
"IBAN": "SE4550000000058398257466",
"BIC": "ESSESESS",
"lastInvitationDate": null,
"dateCreated": "2026-10-13T12:31:14Z",
"isAdministrator": false
}