---
search:
  tags:
    - Users
    - PUT
seo:
  description: >-
    Replaces the scopes one of the caller's member's users holds. Requires the…
    Reference for the PUT /users/{user_id}/scopes endpoint in the REST API.
sidebar:
  label: Replace a User's Scopes
  badge: PUT
title: Replace a User's Scopes
type: openapi-operation
---
Replaces the scopes one of the caller's member's users holds. Requires the users:manage scope on an unrestricted credential.

### Endpoint

- Method and path: `PUT /users/{user_id}/scopes`
- Operation ID: `putUserScopes`
- API reference: [PUT /users/{user_id}/scopes](/api-reference/rest/users/put-user-scopes)
- Complete specification: [OpenAPI (YAML)](/openapi.yml)
- Spec location (JSON Pointer): `#/paths/~1users~1{user_id}~1scopes/put`

#### Authorization

- Accepted credentials: `UDX-Access-Key` header and `UDX-Access-Timestamp` header and `UDX-Access-Signature` header; or Bearer token in `Authorization`
- Details: [Authentication](/reference/authentication)

#### Parameters

```yaml
- $ref: "#/components/parameters/VersionHeader"
- $ref: "#/components/parameters/IdempotencyKeyHeader"
- $ref: "#/components/parameters/ManagedUserId"
```


#### Request body

Required: yes

Content type: `application/json`

Schema:

```yaml
$ref: "#/components/schemas/PutUserScopesRequest"
```

Example: Example

```json
{
  "scopes": [
    "read",
    "trade"
  ]
}
```


#### Responses

##### `200`

The user with its replaced scopes.

Headers:

```yaml
UDX-Version:
  $ref: "#/components/headers/VersionHeader"
UDX-Idempotent-Replayed:
  $ref: "#/components/headers/IdempotentReplayed"
```

Content type: `application/json`

Schema:

```yaml
$ref: "#/components/schemas/MemberUserResponse"
```

Example: Example

```json
{
  "user": {
    "id": "1194626289313312742",
    "status": "active",
    "scopes": [
      "read",
      "trade"
    ],
    "created_at": "2026-07-16T09:30:00.000000Z"
  }
}
```

##### `400`

The request doesn't conform to this spec.

Headers:

```yaml
UDX-Version:
  $ref: "#/components/headers/VersionHeader"
```

Content type: `application/problem+json`

Schema:

```yaml
$ref: "#/components/schemas/ProblemDetails"
```

Example: Invalid request parameters

```json
{
  "type": "urn:udx:problem:invalid-request-parameters",
  "title": "Bad Request",
  "status": 400,
  "detail": "invalid request parameters",
  "instance": "urn:request-id:8f14e45f-ceea-4abc-a743-e89a34d3f6ef"
}
```

Example: Unknown UDX-Version

```json
{
  "type": "urn:udx:problem:unknown-version",
  "title": "Bad Request",
  "status": 400,
  "detail": "unknown UDX-Version \"1999-01-01\"; supported versions: 2026-07-15",
  "instance": "urn:request-id:8f14e45f-ceea-4abc-a743-e89a34d3f6ef"
}
```

##### `401`

No valid credential was provided.

Headers:

```yaml
UDX-Version:
  $ref: "#/components/headers/VersionHeader"
```

Content type: `application/problem+json`

Schema:

```yaml
$ref: "#/components/schemas/ProblemDetails"
```

Example: Authentication failed

```json
{
  "type": "urn:udx:problem:invalid-authentication-credentials",
  "title": "Unauthorized",
  "status": 401,
  "detail": "invalid authentication credentials",
  "instance": "urn:request-id:8f14e45f-ceea-4abc-a743-e89a34d3f6ef"
}
```

##### `403`

The credential lacks the users:manage scope, is restricted to one account, or the change adds or removes a scope the caller does not hold.

Headers:

```yaml
UDX-Version:
  $ref: "#/components/headers/VersionHeader"
```

Content type: `application/problem+json`

Schema:

```yaml
$ref: "#/components/schemas/ProblemDetails"
```

Example: Missing users:manage

```json
{
  "type": "urn:udx:problem:insufficient-permissions",
  "title": "Forbidden",
  "status": 403,
  "detail": "insufficient permissions",
  "instance": "urn:request-id:8f14e45f-ceea-4abc-a743-e89a34d3f6ef"
}
```

Example: Scope change exceeds the caller

```json
{
  "type": "urn:udx:problem:scope-change-exceeds-caller",
  "title": "Forbidden",
  "status": 403,
  "detail": "scope change exceeds the caller's own scopes",
  "instance": "urn:request-id:8f14e45f-ceea-4abc-a743-e89a34d3f6ef"
}
```

##### `404`

The user doesn't exist or is not one of the caller's member's users.

Headers:

```yaml
UDX-Version:
  $ref: "#/components/headers/VersionHeader"
```

Content type: `application/problem+json`

Schema:

```yaml
$ref: "#/components/schemas/ProblemDetails"
```

Example: Example

```json
{
  "type": "urn:udx:problem:user-not-found",
  "title": "Not Found",
  "status": 404,
  "detail": "user not found",
  "instance": "urn:request-id:8f14e45f-ceea-4abc-a743-e89a34d3f6ef"
}
```

##### `409`

The caller is the member's last users:manage holder and asked to remove it from themselves, or a request with this idempotency key is still in progress.

Headers:

```yaml
UDX-Version:
  $ref: "#/components/headers/VersionHeader"
```

Content type: `application/problem+json`

Schema:

```yaml
$ref: "#/components/schemas/ProblemDetails"
```

Example: Example

```json
{
  "type": "urn:udx:problem:last-users-manage-holder",
  "title": "Conflict",
  "status": 409,
  "detail": "the member's last users:manage holder cannot remove it from themselves",
  "instance": "urn:request-id:8f14e45f-ceea-4abc-a743-e89a34d3f6ef"
}
```

##### `422`

This idempotency key belongs to a different request.

Headers:

```yaml
UDX-Version:
  $ref: "#/components/headers/VersionHeader"
```

Content type: `application/problem+json`

Schema:

```yaml
$ref: "#/components/schemas/ProblemDetails"
```

Example: Example

```json
{
  "type": "urn:udx:problem:header-used-for-different-request",
  "title": "Unprocessable Entity",
  "status": 422,
  "detail": "UDX-Idempotency-Key was already used for a different request",
  "instance": "urn:request-id:8f14e45f-ceea-4abc-a743-e89a34d3f6ef"
}
```

##### `429`

The member rate limit was exceeded.

Headers:

```yaml
UDX-Version:
  $ref: "#/components/headers/VersionHeader"
Retry-After:
  $ref: "#/components/headers/RetryAfter"
Cache-Control:
  $ref: "#/components/headers/NoStore"
```

Content type: `application/problem+json`

Schema:

```yaml
$ref: "#/components/schemas/ProblemDetails"
```

Example: Example

```json
{
  "type": "urn:udx:problem:member-rate-limit-exceeded",
  "title": "Too Many Requests",
  "status": 429,
  "detail": "this member has temporarily exceeded its request rate",
  "instance": "urn:request-id:8f14e45f-ceea-4abc-a743-e89a34d3f6ef"
}
```

##### `500`

Something went wrong on UDX's side.

Headers:

```yaml
UDX-Version:
  $ref: "#/components/headers/VersionHeader"
```

Content type: `application/problem+json`

Schema:

```yaml
$ref: "#/components/schemas/ProblemDetails"
```

Example: Internal server error

```json
{
  "type": "urn:udx:problem:internal-error",
  "title": "Internal Server Error",
  "status": 500,
  "detail": "internal error",
  "instance": "urn:request-id:8f14e45f-ceea-4abc-a743-e89a34d3f6ef"
}
```

##### `503`

Request admission is unavailable.

Headers:

```yaml
UDX-Version:
  $ref: "#/components/headers/VersionHeader"
Cache-Control:
  $ref: "#/components/headers/NoStore"
```

Content type: `application/problem+json`

Schema:

```yaml
$ref: "#/components/schemas/ProblemDetails"
```

Example: Admission temporarily unavailable

```json
{
  "type": "urn:udx:problem:request-admission-unavailable",
  "title": "Service Unavailable",
  "status": 503,
  "detail": "request admission is temporarily unavailable",
  "instance": "urn:request-id:8f14e45f-ceea-4abc-a743-e89a34d3f6ef"
}
```


#### Referenced definitions

The references in the excerpts above resolve to these definitions in the complete specification.

##### `#/components/schemas/PutUserScopesRequest`

```yaml
type: object
additionalProperties: false
description: The complete set of scopes the user should hold.
required:
  - scopes
properties:
  scopes:
    type: array
    maxItems: 7
    uniqueItems: true
    items:
      $ref: "#/components/schemas/APIKeyScope"
    description: Replaces the user's scopes. An empty list removes every scope. Every scope added or removed must be one the caller holds.
```

##### `#/components/schemas/APIKeyScope`

```yaml
type: string
description: A permission granted to an API key.
enum:
  - accounts:manage
  - funds:transfer
  - grants:manage
  - keys:manage
  - read
  - trade
  - users:manage
```

##### `#/components/headers/VersionHeader`

```yaml
description: API version used for this response.
schema:
  type: string
  maxLength: 10
  description: A dated API version (YYYY-MM-DD).
  example: 2026-07-15
```

##### `#/components/headers/IdempotentReplayed`

```yaml
description: true for a replayed response; omitted otherwise.
schema:
  type: string
  enum:
    - "true"
  description: Always the string true when present.
  example: "true"
```

##### `#/components/schemas/MemberUserResponse`

```yaml
type: object
description: One of the caller's member's users.
required:
  - user
properties:
  user:
    $ref: "#/components/schemas/MemberUser"
```

##### `#/components/schemas/MemberUser`

```yaml
type: object
description: One of the caller's member's users.
required:
  - id
  - status
  - scopes
  - created_at
properties:
  id:
    $ref: "#/components/schemas/EntityId"
  scopes:
    type: array
    maxItems: 7
    items:
      $ref: "#/components/schemas/APIKeyScope"
    description: The scopes the user holds.
  status:
    type: string
    description: The user's access state.
    enum:
      - pending
      - active
      - suspended
  created_at:
    type: string
    format: date-time
    maxLength: 40
    description: When this user was created.
```

##### `#/components/schemas/EntityId`

```yaml
type: string
minLength: 1
description: An exchange-assigned identifier. Treat it as an opaque, stable key with no internal structure.
example: "6820943174116859281"
```

##### `#/components/schemas/ProblemDetails`

```yaml
type: object
description: An RFC 9457 machine-readable error, returned on every non-2xx response. The response's Content-Language header identifies the language used by title and detail, and Vary includes Accept-Language.
required:
  - type
  - title
  - status
properties:
  type:
    type: string
    format: uri-reference
    maxLength: 2048
    description: A stable URN identifying the kind of problem, for example urn:udx:problem:insufficient-permissions. Branch on it rather than on the localized detail. It is an identifier, not a URL to dereference.
  title:
    type: string
    maxLength: 40
    example: Bad Request
    description: A localized, human-readable summary of the error category. Stable for a given status code and resolved language — clients must not use it as a machine-readable discriminator.
  status:
    type: integer
    example: 400
    description: The HTTP status code, repeated from the response itself.
  detail:
    type: string
    maxLength: 500
    example: malformed request body
    description: A localized, human-readable explanation specific to this occurrence. Clients must not parse it for machine-readable information.
  instance:
    type: string
    format: uri-reference
    maxLength: 100
    example: urn:request-id:8f14e45f-ceea-4abc-a743-e89a34d3f6ef
    description: An identifier for this specific occurrence, so it can be correlated with server-side logs if you need to report it.
```

##### `#/components/headers/RetryAfter`

```yaml
description: Whole seconds to wait before retrying.
schema:
  type: integer
  minimum: 1
  description: A positive delay in whole seconds.
  example: 2
```

##### `#/components/headers/NoStore`

```yaml
description: Prevents caching this response.
schema:
  type: string
  enum:
    - no-store
  description: Always the cache directive no-store.
  example: no-store
```

##### `#/components/parameters/VersionHeader`

```yaml
name: UDX-Version
in: header
required: false
description: Dated API version (YYYY-MM-DD).
schema:
  type: string
  minLength: 10
  maxLength: 10
  description: A dated API version (YYYY-MM-DD).
  example: 2026-07-15
```

##### `#/components/parameters/IdempotencyKeyHeader`

```yaml
name: UDX-Idempotency-Key
in: header
required: false
description: Optional client-generated key that makes a mutation safe to retry.
schema:
  type: string
  minLength: 1
  maxLength: 255
  description: A unique, client-generated key identifying this request.
  example: b6f1c2a4-2b7e-4c1a-9c2e-2d1f8a3e4b5c
```

##### `#/components/parameters/ManagedUserId`

```yaml
name: user_id
in: path
required: true
description: The public identifier of one of the caller's member's users.
schema:
  $ref: "#/components/schemas/EntityId"
```