Update User - Plugixa Advanced User Role Editor for WordPress

PATCH /plugixa-aure/v1/users/{id}

Set an account’s roles (in order), the capabilities on the account itself, or both.

Needs the Edit people permission: plugixa_aure_edit_users. Part of the Users feature: when it is switched off in Settings the route is not registered and answers 404.

Note. Both fields replace, they do not merge. roles is the complete list: a role missing from it is taken away. capabilities is the account’s complete own map: a capability set on the account and missing from it is removed.

Note. With both fields, the roles are saved first and the capabilities second, as two writes. If the capabilities are refused, the new roles stay.

Request

PATCH https://your-site.example/wp-json/plugixa-aure/v1/users/12

Path parameters

Name	Type	Description
`id`	`integer`	The account id

Request body

Content type: application/json

Field	Type	Required	Description
`roles`	`array`	No	Role slugs in the order the account should hold them. When roles disagree about a capability, WordPress follows the last one. Duplicates and empty entries are dropped; at least one role must remain.
`capabilities`	`object`	No	Capability to `true` (grant) or `false` (block) on the account itself. Values that are not real JSON booleans are dropped. A key may not be the name of a role the account holds.

Every change goes through the safety guardrails: you cannot change an account that holds capabilities you lack, give a role or capability you do not hold, remove the last administrator, or lock yourself out. A restore point is taken before each write. Send neither field and the account is returned unchanged.

{
  "roles": [
    "author",
    "editor"
  ],
  "capabilities": {
    "upload_files": false
  }
}

Responses

`200` OK. `data` is the account as saved.

{
  "success": true,
  "data": {
    "user": {
      "id": 12,
      "login": "maria",
      "name": "Maria Lopez",
      "email": "maria@example.com",
      "roles": [
        "author",
        "editor"
      ],
      "overrides": 1,
      "version": "c7e2915b0d34",
      "caps": {
        "upload_files": false
      },
      "registered": "2026-03-04T08:12:45Z",
      "superAdmin": false,
      "editable": true,
      "avatar": "https://secure.gravatar.com/avatar/0f1e2d3c4b5a?s=48&d=mm&r=g"
    },
    "overrides": {
      "upload_files": false
    },
    "effective": {
      "user": {
        "id": 12,
        "login": "maria",
        "name": "Maria Lopez",
        "email": "maria@example.com",
        "roles": [
          "author",
          "editor"
        ]
      },
      "super_admin": false,
      "capabilities": [
        {
          "cap": "edit_others_posts",
          "granted": true,
          "source": "role",
          "via": "editor"
        },
        {
          "cap": "edit_posts",
          "granted": true,
          "source": "role",
          "via": "editor"
        },
        {
          "cap": "publish_posts",
          "granted": true,
          "source": "role",
          "via": "editor"
        },
        {
          "cap": "read",
          "granted": true,
          "source": "role",
          "via": "editor"
        },
        {
          "cap": "upload_files",
          "granted": false,
          "source": "user",
          "via": "maria"
        }
      ]
    }
  }
}

Same shape as Get User.

Errors

Status	Code	When
`404`	`plugixa_aure_unknown_user`	No account with that id.
`422`	`plugixa_aure_no_roles`	`roles` is empty after cleaning.
`409`	`plugixa_aure_cap_is_role`	A key in `capabilities` is the name of a role the account holds.
`403`	`plugixa_aure_user_not_editable`	The account holds a role with capabilities you do not hold yourself.
`404`	`plugixa_aure_unknown_role`	A role in `roles` does not exist.
`403`	`plugixa_aure_cannot_grant`	The change grants, or lifts a block on, a capability you do not hold yourself.
`403`	`plugixa_aure_cannot_revoke`	The change takes away, or blocks, a capability you do not hold yourself.
`409`	`plugixa_aure_last_administrator`	The account is the only administrator and would lose the role (single site only).
`409`	`plugixa_aure_self_lockout`	The change would remove your own access to the editor.

Plus the errors every endpoint can return.

Examples

curl -s -X PATCH "https://your-site.example/wp-json/plugixa-aure/v1/users/12" \
  -u "admin:$WP_APP_PASSWORD" \
  -H "Content-Type: application/json" \
  -d '{"roles":["author","editor"],"capabilities":{"upload_files":false}}'

<?php
$ch = curl_init('https://your-site.example/wp-json/plugixa-aure/v1/users/12');
curl_setopt_array($ch, [
    CURLOPT_CUSTOMREQUEST  => 'PATCH',
    CURLOPT_RETURNTRANSFER => true,
    CURLOPT_USERPWD        => 'admin:' . getenv('WP_APP_PASSWORD'),
    CURLOPT_HTTPHEADER     => ['Content-Type: application/json'],
    CURLOPT_POSTFIELDS     => json_encode([
        'roles'        => ['author', 'editor'],
        'capabilities' => [
            'upload_files' => false,
        ],
    ]),
]);
$response = json_decode(curl_exec($ch), true);
curl_close($ch);

const response = await fetch('https://your-site.example/wp-json/plugixa-aure/v1/users/12', {
  method: 'PATCH',
  headers: {
    'Authorization': 'Basic ' + btoa(`admin:${process.env.WP_APP_PASSWORD}`),
    'Content-Type': 'application/json',
  },
  body: JSON.stringify({ roles: ['author', 'editor'], capabilities: { upload_files: false } }),
});
const { data } = await response.json();