---
updatedAt: 2026-05-02T21:29:11.000Z
agentTools:
  projectIndex: https://developer.tenable.com/llms.txt
---

# Update user authorizations

Updates user authorizations for accessing a Tenable Vulnerability Management instance. Use the endpoint to grant and revoke authorizations.

**Note:** You cannot update authorizations for the current user.

For background information about managing user authorizations, see [Manage User Access Authorizations](https://docs.tenable.com/vulnerability-management/Content/Settings/access-control/ManageUserAccessAuthorizations.htm) in the _Tenable Vulnerability Management User Guide_.<div class="perms-callout">Requires the Administrator [64] user role or the `PS.ACCT_MGMT.AM_ACCESS_CONTROL.EDIT` custom role privilege. See [Roles](doc:roles).</div>

# OpenAPI definition

```json
{
  "openapi": "3.1.2",
  "info": {
    "title": "Tenable Platform & Settings",
    "version": "1.0.0"
  },
  "servers": [
    {
      "url": "https://cloud.tenable.com"
    }
  ],
  "tags": [
    {
      "name": "Access Control (Users)",
      "x-displayName": "Access Control (Users)"
    }
  ],
  "paths": {
    "/users/{user_id}/authorizations": {
      "put": {
        "summary": "Update user authorizations",
        "description": "Updates user authorizations for accessing a Tenable Vulnerability Management instance. Use the endpoint to grant and revoke authorizations.\n\n**Note:** You cannot update authorizations for the current user.\n\nFor background information about managing user authorizations, see [Manage User Access Authorizations](https://docs.tenable.com/vulnerability-management/Content/Settings/access-control/ManageUserAccessAuthorizations.htm) in the _Tenable Vulnerability Management User Guide_.<div class=\"perms-callout\">Requires the Administrator [64] user role or the `PS.ACCT_MGMT.AM_ACCESS_CONTROL.EDIT` custom role privilege. See [Roles](doc:roles).</div>",
        "operationId": "users-update-auths",
        "tags": [
          "Access Control (Users)"
        ],
        "parameters": [
          {
            "description": "Specifies the unique identifier (UUID) of the user. To determine the user UUID, use the [GET /users](ref:users-list) endpoint.",
            "required": true,
            "name": "user_id",
            "in": "path",
            "schema": {
              "type": "string",
              "format": "uuid"
            }
          }
        ],
        "requestBody": {
          "required": true,
          "content": {
            "application/json": {
              "schema": {
                "$ref": "#/components/schemas/Access_Control_Users_authorizations_update"
              }
            }
          }
        },
        "responses": {
          "204": {
            "description": "Returned if Tenable Vulnerability Management successfully updated the specified user's authorizations.",
            "content": {
              "application/json": {
                "schema": {},
                "examples": {
                  "response": {
                    "value": {}
                  }
                }
              }
            }
          },
          "400": {
            "description": "Returned if your request specified invalid parameters or if your request was improperly formatted.",
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/Access_Control_Users_ErrorResponse-Error"
                },
                "examples": {
                  "response": {
                    "value": {
                      "error": "Unexpected character ('}' (code 125)): was expecting double-quote to start field name\n at [(String)\"{\r\n\"api_permitted\" : true,\r\n}\"; line: 3, column: 2]"
                    }
                  }
                }
              }
            }
          },
          "401": {
            "description": "Returned if the API keys specified in your request are invalid.",
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/Access_Control_Users_ErrorResponse"
                },
                "examples": {
                  "response": {
                    "value": {
                      "statusCode": 401,
                      "error": "Unauthorized",
                      "message": "Invalid credentials."
                    }
                  }
                }
              }
            }
          },
          "404": {
            "description": "Returned if Tenable Vulnerability Management cannot find the specified user.",
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/Access_Control_Users_ErrorResponse-Error"
                },
                "examples": {
                  "response": {
                    "value": {
                      "error": "User[UUID=6ab5bc4a-f829-483d-ae75-57c36bb2febd] not found."
                    }
                  }
                }
              }
            }
          },
          "429": {
            "description": "Returned if you attempt to send too many requests in a specific period of time. For more information, see [Rate Limiting](doc:rate-limiting).",
            "content": {
              "text/html": {
                "examples": {
                  "response": {
                    "value": "<html>\n\n<head>\n    <title>429 Too Many Requests</title>\n</head>\n\n<body bgcolor=\"white\">\n    <center>\n        <h1>429 Too Many Requests</h1>\n    </center>\n    <hr>\n    <center>nginx</center>\n</body>\n\n</html>"
                  }
                }
              }
            }
          },
          "500": {
            "description": "Returned if an internal error occurred.",
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/Access_Control_Users_ErrorResponse"
                },
                "examples": {
                  "response": {
                    "value": {
                      "statusCode": 500,
                      "error": "Internal Server Error",
                      "message": "An internal server error occurred. Please wait a moment and try your request again."
                    }
                  }
                }
              }
            }
          }
        },
        "security": [
          {
            "cloud": []
          }
        ]
      }
    }
  },
  "components": {
    "securitySchemes": {
      "cloud": {
        "type": "apiKey",
        "in": "header",
        "name": "X-ApiKeys",
        "description": "Format - accessKey=ACCESS_KEY;secretKey=SECRET_KEY"
      }
    },
    "schemas": {
      "Access_Control_Users_authorizations_update": {
        "type": "object",
        "description": "An object specifying the authorization settings to apply to the user. Set each property to `true` to grant the authorization or `false` to revoke it.",
        "properties": {
          "api_permitted": {
            "type": "boolean",
            "description": "Specifies whether API key authentication is authorized for the user."
          },
          "password_permitted": {
            "type": "boolean",
            "description": "Specifies whether username and password login is authorized for the user."
          },
          "saml_permitted": {
            "type": "boolean",
            "description": "Specifies whether SSO with SAML is authorized for the user."
          },
          "mfa_enrollment_required": {
            "type": "boolean",
            "description": "Specifies whether two-factor authentication enrollment is required for the user."
          }
        },
        "required": [
          "api_permitted",
          "password_permitted",
          "saml_permitted"
        ]
      },
      "Access_Control_Users_ErrorResponse": {
        "type": "object",
        "properties": {
          "statusCode": {
            "type": "integer",
            "description": "The HTTP status code of the error."
          },
          "error": {
            "type": "string",
            "description": "The standard HTTP error name."
          },
          "message": {
            "type": "string",
            "description": "A brief message about the cause of the error."
          }
        }
      },
      "Access_Control_Users_ErrorResponse-Error": {
        "type": "object",
        "properties": {
          "error": {
            "type": "string",
            "description": "A brief description of the error."
          }
        }
      }
    }
  },
  "x-readme": {
    "proxy-enabled": false,
    "samples-languages": [
      "python",
      "curl",
      "node",
      "powershell",
      "ruby",
      "javascript",
      "objectivec",
      "java",
      "php",
      "csharp",
      "go",
      "swift",
      "kotlin"
    ]
  }
}
```