## Update employee

`PATCH /v1/users/:id`

Updates fields of an existing employee. Pass only the fields being changed. Requires Bitrix24 account administrator rights on the Bitrix24 side — without them the call is rejected.

## Request fields (body)

| Parameter | Type | Description |
|----------|-----|---------|
| `workPosition` | string | Position |
| `departmentId` | number[] | Array of department IDs. List: `GET /v1/departments` |
| `email` | string | Email — must remain unique within the Bitrix24 account |
| `workPhone` / `personalPhone` / `personalMobile` | string | Phones |
| `active` | boolean | Reactivate (`true`) or deactivate (`false`) — deactivation is equivalent to [`DELETE /v1/users/:id`](/docs/entities/users/delete) |

Full field list — [Employee fields](/docs/entities/users/fields). User (`UF_*`) fields are accepted.

## Examples

### curl — personal key

```bash
curl -X PATCH "https://vibecode.bitrix24.com/v1/users/29" \
  -H "X-Api-Key: YOUR_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "workPosition": "Senior manager",
    "departmentId": [1, 47]
  }'
```

### curl — OAuth application

```bash
curl -X PATCH "https://vibecode.bitrix24.com/v1/users/29" \
  -H "X-Api-Key: YOUR_APP_KEY" \
  -H "Authorization: Bearer USER_SESSION_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{
    "workPosition": "Senior manager",
    "departmentId": [1, 47]
  }'
```

### JavaScript — personal key

```javascript
const res = await fetch('https://vibecode.bitrix24.com/v1/users/29', {
  method: 'PATCH',
  headers: {
    'X-Api-Key': 'YOUR_API_KEY',
    'Content-Type': 'application/json',
  },
  body: JSON.stringify({
    workPosition: 'Senior manager',
    departmentId: [1, 47],
  }),
})

const { success, data } = await res.json()
```

### JavaScript — OAuth application

```javascript
const res = await fetch('https://vibecode.bitrix24.com/v1/users/29', {
  method: 'PATCH',
  headers: {
    'X-Api-Key': 'YOUR_APP_KEY',
    'Authorization': 'Bearer USER_SESSION_TOKEN',
    'Content-Type': 'application/json',
  },
  body: JSON.stringify({
    workPosition: 'Senior manager',
    departmentId: [1, 47],
  }),
})

const { success, data } = await res.json()
```

## Response fields

| Field | Type | Description |
|------|-----|---------|
| `success` | boolean | Always `true` on success |
| `data` | object | The updated employee object with all fields — the same format as [`GET /v1/users/:id`](/docs/entities/users/get) |

## Response example

```json
{
  "success": true,
  "data": {
    "id": 29,
    "name": "John",
    "lastName": "Brown",
    "email": "john.brown@example.com",
    "active": true,
    "workPosition": "Senior manager",
    "departmentId": [1, 47],
    "userType": "employee"
  }
}
```

## Error response example

403 — update rejected by Bitrix24:

```json
{
  "success": false,
  "error": {
    "code": "UPDATE_FAILED",
    "message": "Bitrix24 rejected user.update (result: false)",
    "hint": "Bitrix24 returns false when the calling user lacks portal admin rights, when a read-only field was touched (isOnline, lastLogin, dateRegister, isAdmin), or when the target user ID does not exist. Verify the webhook/OAuth identity is a portal admin."
  }
}
```

## Errors

| HTTP | Code | Description |
|------|-----|---------|
| 400 | `INVALID_ID` | `:id` is not a positive integer |
| 400 | `READONLY_FIELD` | A read-only field was passed in the request body (`id`, `isOnline`, `isAdmin`, `lastLogin`, `dateRegister`, `lastActivityDate`, `userType`, `timestampX`). Vibecode rejects it before the Bitrix24 call |
| 400 | `BITRIX_ERROR` | Bitrix24 rejected a field — for example, `wrong_email` when trying to set an already taken email |
| 401 | `TOKEN_MISSING` | The API key has no configured tokens |
| 403 | `SCOPE_DENIED` | The API key lacks the `user` scope |
| 403 | `UPDATE_FAILED` | Bitrix24 returned `result: false` for the update request. Most often — the key owner has no Bitrix24 account administrator rights |

Full list of common API errors — [Errors](/docs/errors).

## Known specifics

**Changing email.** If the new email is already taken by another employee in the Bitrix24 account, Bitrix24 returns `BITRIX_ERROR: wrong_email`. Before PATCH — check via `GET /v1/users?filter[EMAIL]=new@example.com`.

## See also

- [Get employee](/docs/entities/users/get) — current field values
- [Employee fields](/docs/entities/users/fields) — which fields can be changed
- [Deactivate employee](/docs/entities/users/delete) — reversible deactivation
- [Batch](/docs/batch) — bulk update
- [Limits and optimization](/docs/optimization)