Update role

What this does: Completely replaces a custom role with new data. All fields must be provided - this is a full replacement, not a partial update.

Important restrictions:

Base roles (Root, CEO, Team Leader, Staff, Guest) cannot be updated
Only custom roles created by users can be modified
Attempting to update a base role will return an error

What must be provided:

name: Role display name
icon: Icon identifier
type: Role type (normal or guest)
description: Role description (can be empty string)
parentId: Parent role ID (can be undefined)
permissions: Complete permission map (all permissions must be specified)

Permission validation:

All permissions are validated against disallowed permissions for the role type
Guest roles cannot have certain permissions (e.g., workspace administration)
Invalid permission combinations are rejected

Use cases:

Completely redesign a role’s permissions and properties
Migrate a role from one parent to another
Update role metadata (name, description, icon) along with permissions

Note: For partial updates, use PATCH /roles/ instead.

PUT/administration/roles/{id}

Authorization

AuthorizationOAuth2 access token · headerrequired

Scopes:api:write

AuthorizationBearer token (JWT) · headerrequired

Path parameters

idstringrequired

Query parameters

fieldsToReturnstring

Comma-separated list of top-level response fields to return. Overrides the endpoint compact default unless responseShape=full is used.

responseShapestring

Advanced override. Omit for the endpoint compact default. Use full only when you need the complete endpoint response, including nested fields that are not selectable with fieldsToReturn.

Allowed:compactfull

Header parameters

LT-Response-Shapestring

Advanced override. Set to full only when you need the complete endpoint response, including nested fields that are not selectable with fieldsToReturn.

Allowed:full

Request body

requiredapplication/json

descriptionstring

Human-readable description explaining the role purpose and responsibilities. Maximum 400 characters.

iconstringrequired

Icon identifier for the role. Can be a RemixIcon class name (e.g., "ri-user-star-line") or an emoji code (e.g., ":person_in_tuxedo:"). Used for visual identification in role lists and user interfaces.

namestringrequired

Display name for the role. This is shown in user interfaces when selecting or displaying roles.

parentIdstring

ID of the parent role for permission inheritance. If provided, this role will inherit all permissions from the parent role. Inherited permissions can be overridden by explicitly setting them in the permissions map. Must not create circular dependencies (cannot set a child role as parent).

permissionsobject

Complete map of permission keys to boolean values. Keys are permission identifiers (e.g., "projects.create", "tasks.delete"). Values are true to allow the permission or false to disallow it. This replaces the entire permission map - all permissions must be specified. Guest roles cannot have certain permissions (e.g., workspace administration).

typestringrequired

Role type determines the intended use case and permission restrictions. "normal" roles are for internal team members (employees, managers). "guest" roles are for external users like clients or partners and have additional permission restrictions.

Allowed:normalguest

Responses

200

createdAtstring<date-time>

ISO 8601 timestamp indicating when this custom role was created. Only present for custom roles, not base roles.

createdBystring

User ID of the person who created this custom role. Only present for custom roles, not base roles.

descriptionstringrequired

Human-readable description of the role purpose and responsibilities, localized based on user language preference.

editedAtstring<date-time>

ISO 8601 timestamp indicating when this custom role was last modified. Only present for custom roles, not base roles.

effectivePermissionsobjectrequired

Permission map after resolving the full parent chain and child overrides.

iconstringrequired

Icon identifier for the role. Can be a RemixIcon class name (e.g., "ri-user-line") or an emoji code (e.g., ":person_in_tuxedo:"). Used for visual identification in role lists.

idstringrequired

Unique identifier for the role. Base roles have IDs containing underscore-prefixed identifiers (e.g., "_root_", "_ceo_", "_staff_"). Custom roles have workspace-prefixed IDs.

namestringrequired

Display name of the role, localized based on user language preference.

parentIdstring

ID of the parent role if this role inherits permissions from another role. Undefined if the role has no parent (e.g., base roles or top-level custom roles).

permissionsobjectrequired

Complete map of all permissions for this role. Keys are permission identifiers (e.g., "projects.create", "tasks.delete"). Values are true if the permission is explicitly allowed, false if explicitly disallowed, or missing if inherited from parent role. This map includes both explicitly set permissions and inherited permissions.

rawPermissionsobjectrequired

Permissions explicitly stored or defined on this role before inheritance.

readOnlybooleanrequired

Boolean flag indicating if this is a base role (system-defined) that cannot be modified or deleted. Base roles include Root, CEO, Team Leader, Staff, and Guest.

typestringrequired

Role type indicating the intended use case. "normal" for internal team members, "guest" for external users. Determines permission restrictions.

401Unauthorized - Invalid or missing authentication token

403Forbidden - Insufficient API scopes or permissions

Request

curl -X PUT "https://leadtime.app/api/public/administration/roles/string" \
  -H "Authorization: Bearer YOUR_ACCESS_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{
  "description": "Leads a delivery team",
  "icon": "ri-user-star-line",
  "name": "Team Lead",
  "parentId": "workspace-id_employee",
  "permissions": {
    "projects.create": true,
    "projects.delete": false
  },
  "type": "normal"
}'

const response = await fetch("https://leadtime.app/api/public/administration/roles/string", {
  method: "PUT",
  headers: {
    "Authorization": "Bearer YOUR_ACCESS_TOKEN",
    "Content-Type": "application/json"
  },
  body: JSON.stringify({
  "description": "Leads a delivery team",
  "icon": "ri-user-star-line",
  "name": "Team Lead",
  "parentId": "workspace-id_employee",
  "permissions": {
    "projects.create": true,
    "projects.delete": false
  },
  "type": "normal"
})
});

import requests

response = requests.put(
    "https://leadtime.app/api/public/administration/roles/string",
    headers={
        "Authorization": "Bearer YOUR_ACCESS_TOKEN",
        "Content-Type": "application/json"
    },
    json={
  "description": "Leads a delivery team",
  "icon": "ri-user-star-line",
  "name": "Team Lead",
  "parentId": "workspace-id_employee",
  "permissions": {
    "projects.create": True,
    "projects.delete": False
  },
  "type": "normal"
},
)

Response

{
  "createdAt": "2024-01-01T00:00:00Z",
  "createdBy": "string",
  "description": "Standard employee role",
  "editedAt": "2024-01-01T00:00:00Z",
  "effectivePermissions": {
    "profile.manage": true,
    "tasks.create": true,
    "tasks.delete": false
  },
  "icon": "ri-user-line",
  "id": "workspace-id_employee",
  "name": "Employee",
  "parentId": "workspace-id_admin",
  "permissions": {
    "projects.create": true,
    "projects.delete": false
  },
  "rawPermissions": {
    "tasks.create": true,
    "tasks.delete": false
  },
  "readOnly": false,
  "type": "normal"
}