## Update

`client.Zones.Users.Update(ctx, id, params) (*User, error)`

**patch** `/zones/{zoneId}/users/{id}`

Update a user

### Parameters

- `id string`

- `params ZoneUserUpdateParams`

  - `ZoneID param.Field[string]`

    Path param: Zone ID

  - `Identifier param.Field[string]`

    Body param: Zone-scoped user identifier

  - `Status param.Field[ZoneUserUpdateParamsStatus]`

    Body param: Status of the user. Set to `disabled` to prevent the user from authenticating and revoke their active sessions, or `active` to re-enable.

    - `const ZoneUserUpdateParamsStatusActive ZoneUserUpdateParamsStatus = "active"`

    - `const ZoneUserUpdateParamsStatusDisabled ZoneUserUpdateParamsStatus = "disabled"`

### Returns

- `type User struct{…}`

  An authenticated user entity

  - `ID string`

    Unique identifier of the user

  - `CreatedAt Time`

    Entity creation timestamp

  - `Email string`

    Email address of the user

  - `EmailVerified bool`

    Whether the email address has been verified

  - `Identifier string`

    Zone-scoped user identifier. Defaults to the user's Keycard ID. When the provider has user_identifier_claim configured, the value is set from that claim at user creation time.

  - `OrganizationID string`

    Organization that owns this user

  - `Status UserStatus`

    Status of the user. Disabled users cannot authenticate.

    - `const UserStatusActive UserStatus = "active"`

    - `const UserStatusDisabled UserStatus = "disabled"`

  - `UpdatedAt Time`

    Entity update timestamp

  - `ZoneID string`

    Zone this user belongs to

  - `AuthenticatedAt string`

    Date when the user was last authenticated

  - `Credentials []UserCredentialUnion`

    Authentication credentials for this user, each carrying its identity provider for federation credentials. Populated only when `expand[]=credentials` is set on the listing endpoint.

    - `type UserCredentialUserCredentialFederation struct{…}`

      Federation credential: the user authenticates through an identity provider.

      - `CreatedAt Time`

        Entity creation timestamp

      - `ProviderID string`

        ID of the identity provider backing this credential. `null` when the source provider has been deleted.

      - `Type string`

        - `const UserCredentialUserCredentialFederationTypeFederation UserCredentialUserCredentialFederationType = "federation"`

      - `UpdatedAt Time`

        Entity update timestamp

      - `Issuer string`

        Issuer identifier of the identity provider.

      - `Provider Provider`

        A Provider is a system that supplies access to Resources and allows actors (Users or Applications) to authenticate.

        - `ID string`

          Unique identifier of the provider

        - `CreatedAt Time`

          Entity creation timestamp

        - `Identifier string`

          User specified identifier, unique within the zone

        - `Name string`

          Human-readable name

        - `OrganizationID string`

          Organization that owns this provider

        - `OwnerType ProviderOwnerType`

          Who owns this provider. Platform-owned providers cannot be modified via API.

          - `const ProviderOwnerTypePlatform ProviderOwnerType = "platform"`

          - `const ProviderOwnerTypeCustomer ProviderOwnerType = "customer"`

        - `Slug string`

          URL-safe identifier, unique within the zone

        - `UpdatedAt Time`

          Entity update timestamp

        - `ZoneID string`

          Zone this provider belongs to

        - `ClientID string`

          OAuth 2.0 client identifier

        - `ClientSecretSet bool`

          Indicates whether a client secret is configured

        - `Description string`

          Human-readable description

        - `Metadata ProviderMetadata`

          Provider metadata

          - `IconURL string`

            Icon URL

        - `Protocols ProviderProtocols`

          Protocol-specific configuration

          - `Oauth2 ProviderProtocolsOauth2`

            OAuth 2.0 protocol configuration

            - `Issuer string`

              OIDC issuer URL used for discovery and token validation.

            - `AuthorizationEndpoint string`

            - `AuthorizationParameters map[string, string]`

              Custom query parameters appended to authorization redirect URLs. Use for non-standard providers (e.g. Google prompt=consent, access_type=offline).

            - `AuthorizationResourceEnabled bool`

              Whether to include the resource parameter in authorization requests.

            - `AuthorizationResourceParameter string`

              The resource parameter value to include in authorization requests. Defaults to "resource" when authorization_resource_enabled is true.

            - `CodeChallengeMethodsSupported []string`

            - `JwksUri string`

            - `RegistrationEndpoint string`

            - `ScopeParameter string`

              The query parameter name for scopes in authorization requests. Defaults to "scope". Slack v2 uses "user_scope".

            - `ScopeSeparator string`

              The separator character for scope values. Defaults to " " (space). Slack v2 uses ",".

            - `ScopesSupported []string`

            - `TokenEndpoint string`

            - `TokenResponseAccessTokenPointer string`

              Dot-separated path to the access token in the token response body. Defaults to "access_token". Slack v2 uses "authed_user.access_token".

          - `Openid ProviderProtocolsOpenid`

            OpenID Connect protocol configuration

            - `ExternalIDClaim string`

              Name of the OIDC claim carrying the stable external id used to correlate logins with externally provisioned (SCIM) users. Defaults to "sub". Set to "oid" for Entra, whose pairwise "sub" differs from the SCIM externalId.

            - `Scopes []string`

              Additional OIDC scopes to request from this provider during authentication (e.g. "groups"). Merged with the default scopes (openid, profile, email).

            - `SingleLogoutEnabled bool`

              When true, logging out of the zone propagates the logout to this provider's end_session_endpoint (RP-initiated logout). Defaults to false.

            - `UserIdentifierClaim string`

              Name of a top-level string claim in this provider's ID Token to use as the user identifier on user creation. When not set, the user's Keycard ID is used.

            - `UserinfoEndpoint string`

        - `Type ProviderType`

          - `const ProviderTypeExternal ProviderType = "external"`

          - `const ProviderTypeKeycardVault ProviderType = "keycard-vault"`

          - `const ProviderTypeKeycardSts ProviderType = "keycard-sts"`

      - `Subject string`

        Subject identifier from the identity provider.

    - `type UserCredentialUserCredentialPassword struct{…}`

      Password credential: the user authenticates with email and password. The email lives on the user.

      - `CreatedAt Time`

        Entity creation timestamp

      - `Type string`

        - `const UserCredentialUserCredentialPasswordTypePassword UserCredentialUserCredentialPasswordType = "password"`

      - `UpdatedAt Time`

        Entity update timestamp

  - `GrantCount int64`

    Delegated-grant count for this user. Populated only when `expand[]=grant_count` is set on the listing endpoint.

  - `Groups []UserGroup`

    Groups this user belongs to within the zone. Populated only when `expand[]=groups` is set on the listing endpoint.

    - `ID string`

      Unique identifier of the group

    - `Identifier string`

      Zone-unique slug that policy rules match on.

    - `Name string`

      Human-readable group name

  - `Issuer string`

    Issuer identifier of the identity provider

  - `ProviderID string`

    Reference to the identity provider. This field is undefined when the source identity provider is deleted but the user is not deleted.

  - `RoleAssignments []UserRoleAssignment`

    Role grants for this user within the zone. Populated only when `expand[]=role-assignments` is set on the listing endpoint.

    - `RoleID string`

      ID of the assigned role

    - `RoleIdentifier string`

      Role identifier: a lowercase slug (letters and digits separated by single hyphens or underscores), unique per owner type within a zone. Role identifiers surface in policy evaluation, so the slug restriction keeps them unambiguous in policy text.

    - `RoleOwnerType string`

      Owner type of the granted role. Disambiguates roles that share an identifier across owner types.

      - `const UserRoleAssignmentRoleOwnerTypePlatform UserRoleAssignmentRoleOwnerType = "platform"`

      - `const UserRoleAssignmentRoleOwnerTypeCustomer UserRoleAssignmentRoleOwnerType = "customer"`

    - `Scope UserRoleAssignmentScope`

      The resource this grant is scoped to, or null when the grant is unscoped (applies to the owning zone itself).

      - `ID string`

        The ID of the scoped resource.

      - `Type string`

        The kind of resource this grant is scoped to (e.g. `zone`).

    - `Source string`

      The principal that holds this grant: `user` when assigned directly to the user, or `group` when inherited through group membership.

      - `const UserRoleAssignmentSourceUser UserRoleAssignmentSource = "user"`

      - `const UserRoleAssignmentSourceGroup UserRoleAssignmentSource = "group"`

    - `GroupID string`

      ID of the group this grant is inherited from. Present only when `source` is `group`.

  - `SessionCount int64`

    Session count for this user. Populated only when `expand[]=session_count` is set on the listing endpoint.

  - `Subject string`

    Subject identifier from the identity provider

### Example

```go
package main

import (
  "context"
  "fmt"

  "github.com/keycardai/keycard-go"
  "github.com/keycardai/keycard-go/option"
)

func main() {
  client := keycard.NewClient(
    option.WithAPIKey("My API Key"),
  )
  user, err := client.Zones.Users.Update(
    context.TODO(),
    "id",
    keycard.ZoneUserUpdateParams{
      ZoneID: "zoneId",
    },
  )
  if err != nil {
    panic(err.Error())
  }
  fmt.Printf("%+v\n", user.ID)
}
```