Skip to content
Leadtime
English
EnglishDeutschNot translated
Esc
↑↓navigate↵open⌘Jpreview

Update role

What this does: Completely replaces a custom role with new data. All fields must be provided - this is a full replacement, not a partial update.

Important restrictions:

  • Base roles (Root, CEO, Team Leader, Staff, Guest) cannot be updated
  • Only custom roles created by users can be modified
  • Attempting to update a base role will return an error

What must be provided:

  • name: Role display name
  • icon: Icon identifier
  • type: Role type (normal or guest)
  • description: Role description (can be empty string)
  • parentId: Parent role ID (can be undefined)
  • permissions: Complete permission map (all permissions must be specified)

Permission validation:

  • All permissions are validated against disallowed permissions for the role type
  • Guest roles cannot have certain permissions (e.g., workspace administration)
  • Invalid permission combinations are rejected

Use cases:

  • Completely redesign a role’s permissions and properties
  • Migrate a role from one parent to another
  • Update role metadata (name, description, icon) along with permissions

Note: For partial updates, use PATCH /roles/ instead.

PUT/administration/roles/{id}
Authorization
AuthorizationOAuth2 access token · headerrequired
Scopes:api:write
or
AuthorizationBearer token (JWT) · headerrequired
Path parameters
idstringrequired
Query parameters
fieldsToReturnstring

Comma-separated list of top-level response fields to return. Overrides the endpoint compact default unless responseShape=full is used.

responseShapestring

Advanced override. Omit for the endpoint compact default. Use full only when you need the complete endpoint response, including nested fields that are not selectable with fieldsToReturn.

Allowed:compactfull
Header parameters
LT-Response-Shapestring

Advanced override. Set to full only when you need the complete endpoint response, including nested fields that are not selectable with fieldsToReturn.

Allowed:full
Request body
requiredapplication/json
descriptionstring

Human-readable description explaining the role purpose and responsibilities. Maximum 400 characters.

iconstringrequired

Icon identifier for the role. Can be a RemixIcon class name (e.g., "ri-user-star-line") or an emoji code (e.g., ":person_in_tuxedo:"). Used for visual identification in role lists and user interfaces.

namestringrequired

Display name for the role. This is shown in user interfaces when selecting or displaying roles.

parentIdstring

ID of the parent role for permission inheritance. If provided, this role will inherit all permissions from the parent role. Inherited permissions can be overridden by explicitly setting them in the permissions map. Must not create circular dependencies (cannot set a child role as parent).

permissionsobject

Complete map of permission keys to boolean values. Keys are permission identifiers (e.g., "projects.create", "tasks.delete"). Values are true to allow the permission or false to disallow it. This replaces the entire permission map - all permissions must be specified. Guest roles cannot have certain permissions (e.g., workspace administration).

typestringrequired

Role type determines the intended use case and permission restrictions. "normal" roles are for internal team members (employees, managers). "guest" roles are for external users like clients or partners and have additional permission restrictions.

Allowed:normalguest
Responses
200
createdAtstring<date-time>

ISO 8601 timestamp indicating when this custom role was created. Only present for custom roles, not base roles.

createdBystring

User ID of the person who created this custom role. Only present for custom roles, not base roles.

descriptionstringrequired

Human-readable description of the role purpose and responsibilities, localized based on user language preference.

editedAtstring<date-time>

ISO 8601 timestamp indicating when this custom role was last modified. Only present for custom roles, not base roles.

effectivePermissionsobjectrequired

Permission map after resolving the full parent chain and child overrides.

iconstringrequired

Icon identifier for the role. Can be a RemixIcon class name (e.g., "ri-user-line") or an emoji code (e.g., ":person_in_tuxedo:"). Used for visual identification in role lists.

idstringrequired

Unique identifier for the role. Base roles have IDs containing underscore-prefixed identifiers (e.g., "root", "ceo", "staff"). Custom roles have workspace-prefixed IDs.

namestringrequired

Display name of the role, localized based on user language preference.

parentIdstring

ID of the parent role if this role inherits permissions from another role. Undefined if the role has no parent (e.g., base roles or top-level custom roles).

permissionsobjectrequired

Complete map of all permissions for this role. Keys are permission identifiers (e.g., "projects.create", "tasks.delete"). Values are true if the permission is explicitly allowed, false if explicitly disallowed, or missing if inherited from parent role. This map includes both explicitly set permissions and inherited permissions.

rawPermissionsobjectrequired

Permissions explicitly stored or defined on this role before inheritance.

readOnlybooleanrequired

Boolean flag indicating if this is a base role (system-defined) that cannot be modified or deleted. Base roles include Root, CEO, Team Leader, Staff, and Guest.

typestringrequired

Role type indicating the intended use case. "normal" for internal team members, "guest" for external users. Determines permission restrictions.

401

Unauthorized - Invalid or missing authentication token

403

Forbidden - Insufficient API scopes or permissions

Try it
Server
Authorization
Parameters
Bodyapplication/json
Request
curl -X PUT "https://leadtime.app/api/public/administration/roles/string" \
  -H "Authorization: Bearer YOUR_ACCESS_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{
  "description": "Leads a delivery team",
  "icon": "ri-user-star-line",
  "name": "Team Lead",
  "parentId": "workspace-id_employee",
  "permissions": {
    "projects.create": true,
    "projects.delete": false
  },
  "type": "normal"
}'
Response
{
  "createdAt": "2019-08-24T14:15:22Z",
  "createdBy": "string",
  "description": "Standard employee role",
  "editedAt": "2019-08-24T14:15:22Z",
  "effectivePermissions": {
    "profile.manage": true,
    "tasks.create": true,
    "tasks.delete": false
  },
  "icon": "ri-user-line",
  "id": "workspace-id_employee",
  "name": "Employee",
  "parentId": "workspace-id_admin",
  "permissions": {
    "projects.create": true,
    "projects.delete": false
  },
  "rawPermissions": {
    "tasks.create": true,
    "tasks.delete": false
  },
  "readOnly": false,
  "type": "normal"
}