Update user roles

PUT

organizations

{organization_id}

users

{user_id}

roles

cURL

curl --request PUT \
  --url https://api.sandbox.parchmenthealth.io/external/v1/organizations/{organization_id}/users/{user_id}/roles \
  --header 'Authorization: Bearer <token>' \
  --header 'Content-Type: application/json' \
  --header 'x-organization-secret: <x-organization-secret>' \
  --data '
{
  "access_roles": [
    "admin",
    "provider"
  ]
}
'

import requests

url = "https://api.sandbox.parchmenthealth.io/external/v1/organizations/{organization_id}/users/{user_id}/roles"

payload = { "access_roles": ["admin", "provider"] }
headers = {
    "x-organization-secret": "<x-organization-secret>",
    "Authorization": "Bearer <token>",
    "Content-Type": "application/json"
}

response = requests.put(url, json=payload, headers=headers)

print(response.text)

const options = {
  method: 'PUT',
  headers: {
    'x-organization-secret': '<x-organization-secret>',
    Authorization: 'Bearer <token>',
    'Content-Type': 'application/json'
  },
  body: JSON.stringify({access_roles: ['admin', 'provider']})
};

fetch('https://api.sandbox.parchmenthealth.io/external/v1/organizations/{organization_id}/users/{user_id}/roles', options)
  .then(res => res.json())
  .then(res => console.log(res))
  .catch(err => console.error(err));

<?php

$curl = curl_init();

curl_setopt_array($curl, [
  CURLOPT_URL => "https://api.sandbox.parchmenthealth.io/external/v1/organizations/{organization_id}/users/{user_id}/roles",
  CURLOPT_RETURNTRANSFER => true,
  CURLOPT_ENCODING => "",
  CURLOPT_MAXREDIRS => 10,
  CURLOPT_TIMEOUT => 30,
  CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
  CURLOPT_CUSTOMREQUEST => "PUT",
  CURLOPT_POSTFIELDS => json_encode([
    'access_roles' => [
        'admin',
        'provider'
    ]
  ]),
  CURLOPT_HTTPHEADER => [
    "Authorization: Bearer <token>",
    "Content-Type: application/json",
    "x-organization-secret: <x-organization-secret>"
  ],
]);

$response = curl_exec($curl);
$err = curl_error($curl);

curl_close($curl);

if ($err) {
  echo "cURL Error #:" . $err;
} else {
  echo $response;
}

package main

import (
	"fmt"
	"strings"
	"net/http"
	"io"
)

func main() {

	url := "https://api.sandbox.parchmenthealth.io/external/v1/organizations/{organization_id}/users/{user_id}/roles"

	payload := strings.NewReader("{\n  \"access_roles\": [\n    \"admin\",\n    \"provider\"\n  ]\n}")

	req, _ := http.NewRequest("PUT", url, payload)

	req.Header.Add("x-organization-secret", "<x-organization-secret>")
	req.Header.Add("Authorization", "Bearer <token>")
	req.Header.Add("Content-Type", "application/json")

	res, _ := http.DefaultClient.Do(req)

	defer res.Body.Close()
	body, _ := io.ReadAll(res.Body)

	fmt.Println(string(body))

}

HttpResponse<String> response = Unirest.put("https://api.sandbox.parchmenthealth.io/external/v1/organizations/{organization_id}/users/{user_id}/roles")
  .header("x-organization-secret", "<x-organization-secret>")
  .header("Authorization", "Bearer <token>")
  .header("Content-Type", "application/json")
  .body("{\n  \"access_roles\": [\n    \"admin\",\n    \"provider\"\n  ]\n}")
  .asString();

require 'uri'
require 'net/http'

url = URI("https://api.sandbox.parchmenthealth.io/external/v1/organizations/{organization_id}/users/{user_id}/roles")

http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true

request = Net::HTTP::Put.new(url)
request["x-organization-secret"] = '<x-organization-secret>'
request["Authorization"] = 'Bearer <token>'
request["Content-Type"] = 'application/json'
request.body = "{\n  \"access_roles\": [\n    \"admin\",\n    \"provider\"\n  ]\n}"

response = http.request(request)
puts response.read_body

{
  "success": true,
  "statusCode": 200,
  "message": "User roles updated successfully",
  "data": {
    "user_id": "usr_abc123def456",
    "access_roles": [
      "admin",
      "provider"
    ]
  },
  "timestamp": "2024-01-15T10:30:00.000Z",
  "requestId": "req_1705312200000_abc123"
}

{
  "success": false,
  "statusCode": 400,
  "error": {
    "type": "https://parchment.health/errors/validation-error",
    "title": "Validation failed",
    "detail": "There were some problems with your input.",
    "instance": "/patients/123",
    "validation": [
      {
        "field": "<string>",
        "message": "<string>",
        "code": "<string>"
      }
    ]
  },
  "timestamp": "2024-01-15T10:30:00.000Z",
  "requestId": "req_1705312200000_def456",
  "code": "RESOURCE_NOT_FOUND",
  "meta": {
    "apiVersion": "1.0"
  }
}

{
  "success": false,
  "statusCode": 400,
  "error": {
    "type": "https://parchment.health/errors/validation-error",
    "title": "Validation failed",
    "detail": "There were some problems with your input.",
    "instance": "/patients/123",
    "validation": [
      {
        "field": "<string>",
        "message": "<string>",
        "code": "<string>"
      }
    ]
  },
  "timestamp": "2024-01-15T10:30:00.000Z",
  "requestId": "req_1705312200000_def456",
  "code": "RESOURCE_NOT_FOUND",
  "meta": {
    "apiVersion": "1.0"
  }
}

{
  "success": false,
  "statusCode": 400,
  "error": {
    "type": "https://parchment.health/errors/validation-error",
    "title": "Validation failed",
    "detail": "There were some problems with your input.",
    "instance": "/patients/123",
    "validation": [
      {
        "field": "<string>",
        "message": "<string>",
        "code": "<string>"
      }
    ]
  },
  "timestamp": "2024-01-15T10:30:00.000Z",
  "requestId": "req_1705312200000_def456",
  "code": "RESOURCE_NOT_FOUND",
  "meta": {
    "apiVersion": "1.0"
  }
}

{
  "success": false,
  "statusCode": 400,
  "error": {
    "type": "https://parchment.health/errors/validation-error",
    "title": "Validation failed",
    "detail": "There were some problems with your input.",
    "instance": "/patients/123",
    "validation": [
      {
        "field": "<string>",
        "message": "<string>",
        "code": "<string>"
      }
    ]
  },
  "timestamp": "2024-01-15T10:30:00.000Z",
  "requestId": "req_1705312200000_def456",
  "code": "RESOURCE_NOT_FOUND",
  "meta": {
    "apiVersion": "1.0"
  }
}

Integration Notes

Role Management: This endpoint specifically handles user role assignments within an organization.
Complete Replacement: The access_roles array completely replaces the user’s current roles.
Role Validation: Invalid roles (not in the allowed list) will cause the request to fail with a 400 error.
Authorization: Requires update:user scope to modify user roles.
Request ID: Always log the requestId for debugging support requests.

Request

{
  "access_roles": ["admin", "provider"]
}

Assign Single Role

{
  "access_roles": ["receptionist"]
}

Request Fields

Field	Type	Required	Description
`access_roles`	string[]	Yes	Array of roles to assign to the user

Valid Roles

The following roles can be assigned via this API:

Role	Description
`admin`	Administrator with extensive permissions
`provider`	Healthcare provider/prescriber
`receptionist`	Manage Patients (no script access)
`rx_reader`	Read-only access to prescriptions (needs to be combined with `receptionist`)
`rx_queue_manager`	Manage the prescription queue on behalf of prescribers — includes patient management and read-only access to prescriptions

rx_queue_manager requires provider identity details. Like provider, this role must be backed by a verified healthcare individual (HPI-I, date of birth, sex, qualifications). These details are captured when the user is created — see Create User. Assigning rx_queue_manager via this endpoint does not collect them, so only assign it to users created with the required identity fields; otherwise create the user with the role directly, or backfill the details via Update User provider_details.

Validation Rules

Required Field: access_roles is required and must be an array
Non-Empty Array: access_roles must contain at least one role (cannot be empty)
Valid Roles: All roles must be from the supported roles list

Response

Success Response (200 OK)

{
  "success": true,
  "statusCode": 200,
  "message": "User roles updated successfully",
  "data": {
    "user_id": "usr_abc123def456",
    "access_roles": ["admin", "provider"]
  },
  "timestamp": "2024-01-15T10:30:00.000Z",
  "requestId": "req_1705312200000_abc123"
}

Bad Request (400 Bad Request)

Invalid Roles

{
    "success": false,
    "statusCode": 400,
    "error": {
        "type": "https://parchment.health/errors/invalid-request",
        "title": "Invalid request",
        "detail": "access_roles must be a non-empty array of valid roles"
    },
    "timestamp": "2025-08-24T08:41:50.042Z",
    "requestId": "1-68aad04d-10c08dde5682893b35b89265"
}

Empty After Filtering

{
    "success": false,
    "statusCode": 400,
    "error": {
        "type": "https://parchment.health/errors/invalid-request",
        "title": "Invalid request",
        "detail": "access_roles must contain at least one valid role after filtering"
    },
    "timestamp": "2025-08-24T08:41:50.042Z",
    "requestId": "1-68aad04d-10c08dde5682893b35b89265"
}

User Not Found (404 Not Found)

{
    "success": false,
    "statusCode": 404,
    "error": {
        "type": "https://parchment.health/errors/resource-not-found",
        "title": "Resource not found",
        "detail": "User not found"
    },
    "timestamp": "2025-08-24T08:43:28.294Z",
    "requestId": "1-68aad0b0-2f3757b01494507a7802998c"
}

Response Fields

Success Response Data

Field	Type	Description
`user_id`	string	Parchment’s unique user identifier
`access_roles`	string[]	Updated array of roles assigned to user

Common Response Fields

All responses include these standard fields:

Field	Type	Description
`success`	boolean	Indicates if the request was successful
`statusCode`	number	HTTP status code
`timestamp`	string	ISO 8601 timestamp of the response
`requestId`	string	Unique identifier for debugging

Status Codes

Code	Status	Description
`200`	OK	User roles successfully updated
`400`	Bad Request	Invalid request format or invalid parameters
`401`	Unauthorized	Authentication required or token invalid
`403`	Forbidden	Insufficient permissions (missing update:user scope)
`404`	Not Found	User not found
`409`	Conflict	Role update conflict
`422`	Unprocessable Entity	Request validation failed
`429`	Too Many Requests	Rate limit exceeded
`500`	Internal Server Error	Unexpected server error

Authorizations

Authorization

string

header

required

Bearer authentication header of the form Bearer <token>, where <token> is your auth token.

Headers

x-organization-secret

string

required

Organization secret for authentication - provided by Parchment

Path Parameters

organization_id

string<uuid>

required

Organization ID

user_id

string<uuid>

required

User ID

Body

application/json

User roles data to update in Parchment

User roles update request

access_roles

enum<string>[]

required

Array of roles to assign to the user

Valid user roles. Note: owner, support, and member roles cannot be assigned via API.

Available options:

admin,

provider,

receptionist,

rx_reader,

rx_queue_manager

Example:

["admin", "provider"]

Response

User roles updated successfully

success

boolean

required

Indicates if the request was successful

Example:

true

statusCode

integer

required

HTTP status code

Example:

200

message

string

required

Human-readable success message

Example:

"User roles updated successfully"

data

object

required

User roles update response data

Show child attributes

timestamp

string<date-time>

required

ISO 8601 timestamp of the response

Example:

"2024-01-15T10:30:00.000Z"

requestId

string

required

Unique identifier for request tracing

Example:

"req_1705312200000_abc123"

code

string

Machine-readable operation code

Example:

"SUCCESS"

pagination

object

Pagination information for list operations

Show child attributes

Disable user

cURL

curl --request PUT \
  --url https://api.sandbox.parchmenthealth.io/external/v1/organizations/{organization_id}/users/{user_id}/roles \
  --header 'Authorization: Bearer <token>' \
  --header 'Content-Type: application/json' \
  --header 'x-organization-secret: <x-organization-secret>' \
  --data '
{
  "access_roles": [
    "admin",
    "provider"
  ]
}
'

import requests

url = "https://api.sandbox.parchmenthealth.io/external/v1/organizations/{organization_id}/users/{user_id}/roles"

payload = { "access_roles": ["admin", "provider"] }
headers = {
    "x-organization-secret": "<x-organization-secret>",
    "Authorization": "Bearer <token>",
    "Content-Type": "application/json"
}

response = requests.put(url, json=payload, headers=headers)

print(response.text)

const options = {
  method: 'PUT',
  headers: {
    'x-organization-secret': '<x-organization-secret>',
    Authorization: 'Bearer <token>',
    'Content-Type': 'application/json'
  },
  body: JSON.stringify({access_roles: ['admin', 'provider']})
};

fetch('https://api.sandbox.parchmenthealth.io/external/v1/organizations/{organization_id}/users/{user_id}/roles', options)
  .then(res => res.json())
  .then(res => console.log(res))
  .catch(err => console.error(err));

<?php

$curl = curl_init();

curl_setopt_array($curl, [
  CURLOPT_URL => "https://api.sandbox.parchmenthealth.io/external/v1/organizations/{organization_id}/users/{user_id}/roles",
  CURLOPT_RETURNTRANSFER => true,
  CURLOPT_ENCODING => "",
  CURLOPT_MAXREDIRS => 10,
  CURLOPT_TIMEOUT => 30,
  CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
  CURLOPT_CUSTOMREQUEST => "PUT",
  CURLOPT_POSTFIELDS => json_encode([
    'access_roles' => [
        'admin',
        'provider'
    ]
  ]),
  CURLOPT_HTTPHEADER => [
    "Authorization: Bearer <token>",
    "Content-Type: application/json",
    "x-organization-secret: <x-organization-secret>"
  ],
]);

$response = curl_exec($curl);
$err = curl_error($curl);

curl_close($curl);

if ($err) {
  echo "cURL Error #:" . $err;
} else {
  echo $response;
}

package main

import (
	"fmt"
	"strings"
	"net/http"
	"io"
)

func main() {

	url := "https://api.sandbox.parchmenthealth.io/external/v1/organizations/{organization_id}/users/{user_id}/roles"

	payload := strings.NewReader("{\n  \"access_roles\": [\n    \"admin\",\n    \"provider\"\n  ]\n}")

	req, _ := http.NewRequest("PUT", url, payload)

	req.Header.Add("x-organization-secret", "<x-organization-secret>")
	req.Header.Add("Authorization", "Bearer <token>")
	req.Header.Add("Content-Type", "application/json")

	res, _ := http.DefaultClient.Do(req)

	defer res.Body.Close()
	body, _ := io.ReadAll(res.Body)

	fmt.Println(string(body))

}

HttpResponse<String> response = Unirest.put("https://api.sandbox.parchmenthealth.io/external/v1/organizations/{organization_id}/users/{user_id}/roles")
  .header("x-organization-secret", "<x-organization-secret>")
  .header("Authorization", "Bearer <token>")
  .header("Content-Type", "application/json")
  .body("{\n  \"access_roles\": [\n    \"admin\",\n    \"provider\"\n  ]\n}")
  .asString();

require 'uri'
require 'net/http'

url = URI("https://api.sandbox.parchmenthealth.io/external/v1/organizations/{organization_id}/users/{user_id}/roles")

http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true

request = Net::HTTP::Put.new(url)
request["x-organization-secret"] = '<x-organization-secret>'
request["Authorization"] = 'Bearer <token>'
request["Content-Type"] = 'application/json'
request.body = "{\n  \"access_roles\": [\n    \"admin\",\n    \"provider\"\n  ]\n}"

response = http.request(request)
puts response.read_body

{
  "success": true,
  "statusCode": 200,
  "message": "User roles updated successfully",
  "data": {
    "user_id": "usr_abc123def456",
    "access_roles": [
      "admin",
      "provider"
    ]
  },
  "timestamp": "2024-01-15T10:30:00.000Z",
  "requestId": "req_1705312200000_abc123"
}

{
  "success": false,
  "statusCode": 400,
  "error": {
    "type": "https://parchment.health/errors/validation-error",
    "title": "Validation failed",
    "detail": "There were some problems with your input.",
    "instance": "/patients/123",
    "validation": [
      {
        "field": "<string>",
        "message": "<string>",
        "code": "<string>"
      }
    ]
  },
  "timestamp": "2024-01-15T10:30:00.000Z",
  "requestId": "req_1705312200000_def456",
  "code": "RESOURCE_NOT_FOUND",
  "meta": {
    "apiVersion": "1.0"
  }
}

{
  "success": false,
  "statusCode": 400,
  "error": {
    "type": "https://parchment.health/errors/validation-error",
    "title": "Validation failed",
    "detail": "There were some problems with your input.",
    "instance": "/patients/123",
    "validation": [
      {
        "field": "<string>",
        "message": "<string>",
        "code": "<string>"
      }
    ]
  },
  "timestamp": "2024-01-15T10:30:00.000Z",
  "requestId": "req_1705312200000_def456",
  "code": "RESOURCE_NOT_FOUND",
  "meta": {
    "apiVersion": "1.0"
  }
}

{
  "success": false,
  "statusCode": 400,
  "error": {
    "type": "https://parchment.health/errors/validation-error",
    "title": "Validation failed",
    "detail": "There were some problems with your input.",
    "instance": "/patients/123",
    "validation": [
      {
        "field": "<string>",
        "message": "<string>",
        "code": "<string>"
      }
    ]
  },
  "timestamp": "2024-01-15T10:30:00.000Z",
  "requestId": "req_1705312200000_def456",
  "code": "RESOURCE_NOT_FOUND",
  "meta": {
    "apiVersion": "1.0"
  }
}

{
  "success": false,
  "statusCode": 400,
  "error": {
    "type": "https://parchment.health/errors/validation-error",
    "title": "Validation failed",
    "detail": "There were some problems with your input.",
    "instance": "/patients/123",
    "validation": [
      {
        "field": "<string>",
        "message": "<string>",
        "code": "<string>"
      }
    ]
  },
  "timestamp": "2024-01-15T10:30:00.000Z",
  "requestId": "req_1705312200000_def456",
  "code": "RESOURCE_NOT_FOUND",
  "meta": {
    "apiVersion": "1.0"
  }
}

API Documentation

Authentication

Authentication Endpoints

Patient Management Endpoints

User Management Endpoints

Custom Drug Endpoints

Update user roles

Integration Notes

Request