# Update a sub-user

`PUT https://api.chat-data.com/api/v2/sub-users/{subUserId}`

Canonical: https://www.chat-data.com/api-reference/update-sub-user

## Authentication

Send an API key as a Bearer token: `Authorization: Bearer $CHAT_DATA_API_KEY`. Workspace keys reach every chatbot in the workspace; chatbot-scoped keys reach only their chatbot. Keep keys on the server.

## Description

Update an existing sub-user's name, password, chatbot assignments, permissions or analytics dashboard sections. Only provided fields are updated; omitted fields remain unchanged.

Requires the SSO Login add-on (see [plans](/pricing)) and a workspace API key; without the add-on, or with a chatbot-scoped key, the request gets a 403.

To remove a sub-user's password (disabling password login), send:
```json
{
  "removePassword": true
}
```

## Parameters

| Name | In | Type | Required | Description |
| --- | --- | --- | --- | --- |
| subUserId | path | string | yes | The unique identifier of the sub-user to update. |

## Request body (`application/json`)

| Field | Type | Required | Description |
| --- | --- | --- | --- |
| name | string | no | Updated display name. HTML tags are stripped. |
| password | string | no | New password. It must meet the same complexity requirements as on creation. If both `password` and `removePassword` are sent, `password` wins and the new password is set. |
| removePassword | boolean | no | Set to `true` to remove the sub-user's password, disabling password login. Ignored when `password` is also sent. |
| chatbotIds | array of string | no | Updated chatbot assignments; replaces the current list. All IDs must belong to chatbots in your workspace. Duplicates are automatically removed. |
| permissions | array of string | no | Updated permissions; replaces the current list. Invalid values are removed, and at least one valid permission is required. |
| analyticsDashboardSections | array of string | no | Updated analytics dashboard sections; replaces the current list. Unknown section names are ignored. |

Send only the fields you want to set; optional fields you omit are left unchanged.

## Example request

```bash
curl -X PUT 'https://api.chat-data.com/api/v2/sub-users/6650f1c2a9e4b83d2c7a1f9a' \
  -H "Authorization: Bearer $CHAT_DATA_API_KEY" \
  -H 'Content-Type: application/json' \
  -d '{}'
```

## Example response (200)

```json
{
  "_id": "6650f1c2a9e4b83d2c7a1f9a",
  "company": "6650f1c2a9e4b83d2c7a1f3c",
  "email": "jane@chat-data.com",
  "name": "Jane Doe",
  "chatbotIds": [
    {
      "_id": "6650f1c2a9e4b83d2c7a1f05",
      "name": "Support Bot"
    }
  ],
  "permissions": [
    "full"
  ],
  "analyticsDashboardSections": [
    "Overview",
    "Chats"
  ],
  "avatar": "",
  "hasPassword": true,
  "hasGoogle": false,
  "createdAt": "2026-10-14T09:30:00.000Z"
}
```

## Responses

| Status | Description |
| --- | --- |
| 200 | Sub-user updated successfully. |
| 400 | The sub-user could not be updated. For example: the workspace has no SSO company, `chatbotIds` is empty or contains an ID that is not a chatbot in your workspace, `name` is not a string or is longer than 100 characters, the password is too weak, `permissions` is empty or contains no valid permission, or `analyticsDashboardSections` is not an array. |
| 401 | Authentication failed: the `Authorization` header is missing or not in the `Bearer <key>` format, the API key does not exist, its workspace is unavailable or has no owner, or the workspace's plan does not include API access. `message` says which. |
| 403 | The request used a chatbot-scoped API key (`This operation requires a user-level API key, not a chatbot-specific key`, with `status: error`), or the workspace does not have the SSO Login add-on (`SSO Login is unavailable with your current plan`, with no `status` field). |
| 404 | `subUserId` is not a valid ID, or the company has no sub-user with this ID. |
| 429 | The workspace sent more than 600 API requests in the last minute. Wait the number of seconds given in the `Retry-After` header (and in `message`) before retrying. |
| 500 | An unexpected error occurred while processing the request; `message` contains the error. |