# `PATCH /companyuser/{id}`

Protected. Requires a valid session cookie (`credentials: 'include'`).

Change a company user's role

Changes the role of a member of the selected company. The last admin cannot be demoted. Admin only.

## Path parameters

| Param | Required | Type | Description |
|-------|----------|------|-------------|
| `id` | yes | integer |  |

## Body (JSON)

| Field | Required | Type | Description |
|-------|----------|------|-------------|
| `role` | yes | string |  |

```json
{
  "role": "admin"
}
```

## Signals

On success, emits SSE signal: `companyuser` (see [`GET /events`](../events.md)).

## Response `200`

Updated company user

```json
{
  "companyuser": {
    "id": 1,
    "googleAuthId": 1,
    "role": "admin"
  }
}
```

## Errors

| Status | Description |
|--------|-------------|
| 400 | Invalid id, role or no company selected — `{"error":"…"}` |
| 401 | Unauthorized — `{"error":"…"}` |
| 403 | Not authorized (admin of the selected company required) — `{"error":"…"}` |
| 404 | Company user not found — `{"error":"…"}` |
| 409 | Cannot demote the last admin — `{"error":"…"}` |

---

_Generated from `@openapi` JSDoc. Do not edit by hand — run `npm run docs:api`._