# Manage user batched

`PATCH https://api.airtable.com/v0/meta/enterpriseAccounts/{enterpriseAccountId}/users`

Batch manage enterprise account users.
One of `id` or `email` must supplied in the body. If both are supplied, `id` will be used as the identifier in changing user email to the `email` specified in the request.

*WARNING:* We recommend performing actions on up to 10 users at a time to avoid timeouts. Though we currently do not enforce a limit on the number of users you can manage at once, we are monitoring the performance of this endpoint and may enforce a limit in the future.

## Requirements

- **Authentication:** [Personal access token](https://airtable.com/developers/web/api/authentication.md#types-of-token), [OAuth integration](https://airtable.com/developers/web/api/authentication.md#types-of-token)
- **Scope:** [`enterprise.user:write`](https://airtable.com/developers/web/api/scopes.md#enterprise-user-write)
- **User role:** Enterprise admin
- **Billing plans:** Enterprise (pre-2023.08 legacy plan), Enterprise Scale

## Path parameters

- `enterpriseAccountId: string`

## Request body

- `users: array<object>` — required

  - `id: string` — optional

    A user ID

  - `state: "provisioned" | "deactivated"` — optional

    [provisioned](https://airtable.com/developers/web/api/org-management-glossary.md#provisioned-user) | [deactivated](https://airtable.com/developers/web/api/org-management-glossary.md#deactivated-user)
    Can only change the state of [managed](https://airtable.com/developers/web/api/org-management-glossary.md#managed-user) users.

  - `email: string` — optional

    Enterprise account must own both the original and destination email domains.

    *WARNING:* If SSO is required for your enterprise account and the user's identity provider
    uses the email address as its SSO NameID, you must follow these steps precisely to avoid
    locking the end user out of their account or creating duplicate accounts.

     - Use this API to update the user's email to a new value (this effectively logs the user out)
     - Use your SSO provider's (e.g. Okta's) admin panel to update the user's email to the new value
     - Tell the user to log into Airtable with the new email

    If the user's identity provider has an email attribute configured (so the SSO NameID is not
    the email address), no pre-work is required: update the email in the identity provider, and
    the change flows through to Airtable on the user's next SSO sign-in or SCIM sync. This avoids
    both the lockout and the duplicate-account risks above.

  - `firstName: string` — optional

  - `lastName: string` — optional

## Response format

- `errors: array<object>` — required

  - `id: string` — optional

    A user ID

  - `type: string` — required

  - `message: string` — required

  - `email: string` — optional

- `updatedUsers: array<object>` — required

  - `id: string` — required

    A user ID

  - `state: "provisioned" | "deactivated"` — optional

    Only returned if it is provided in the request body.

  - `email: string` — optional

    Only returned if it is provided in the request body.

  - `firstName: string` — optional

  - `lastName: string` — optional

### Example — Success response

```sh
curl -X PATCH "https://api.airtable.com/v0/meta/enterpriseAccounts/{enterpriseAccountId}/users" \
-H "Authorization: Bearer YOUR_TOKEN" \
-H "Content-Type: application/json" \
--data '{
    "users": [
      {
        "email": "foo@bar.com",
        "id": "usrL2PNC5o3H4lBEi",
        "state": "provisioned"
      },
      {
        "id": "usrsOEchC9xuwRgKk",
        "state": "deactivated"
      },
      {
        "email": "foo@bam.com",
        "id": "usrL2PNC5o3H4lBEi"
      },
      {
        "email": "bam@bam.com",
        "state": "provisioned"
      }
    ]
  }'
```

```json
{
  "errors": [
    {
      "id": "usrqccqnMB2eHylqB",
      "message": "User not found",
      "type": "MODEL_ID_NOT_FOUND"
    },
    {
      "email": "foo@bam.com",
      "message": "Email not found",
      "type": "NOT_FOUND"
    }
  ],
  "updatedUsers": [
    {
      "email": "foo@bar.com",
      "id": "usrGcrteE5fUMqq0R",
      "state": "provisioned"
    },
    {
      "id": "usrsOEchC9xuwRgKk",
      "state": "deactivated"
    }
  ]
}
```

## Error responses

### 403

**Action on self failure** — Don't deactivate yourself or you might lose access. If action must be performed, add another admin.

```json
{
  "error": {
    "message": "Cannot perform action on self",
    "type": "INVALID_PERMISSIONS"
  }
}
```

**External user account** — Cannot modify external user state since they are not considered part of the enterprise account.

```json
{
  "error": {
    "message": "User does not belong to the enterprise email domain",
    "type": "INVALID_PERMISSIONS"
  }
}
```

**FLA account error** — The provisioned and deactivated states apply only to ELA and "claiming" enterprise accounts. FLA users are always provisioned.

```json
{
  "error": {
    "message": "State modification is not enabled for FLA enterprise accounts",
    "type": "INVALID_PERMISSIONS"
  }
}
```

**Non-managed user account** — Can only manage information of managed users.

```json
{
  "error": {
    "message": "User is not managed by the enterprise account",
    "type": "INVALID_PERMISSIONS"
  }
}
```

### 422

**Email in use failure** — Email cannot be taken already.

```json
{
  "error": {
    "message": "Email already in use",
    "type": "EMAIL_ALREADY_IN_USE"
  }
}
```

**ID or email not specified** — Either id or email must be supplied in the request body.

```json
{
  "error": {
    "message": "Invalid request: either ID or email must be specified. Check your request data.",
    "type": "INVALID_REQUEST_UNKNOWN"
  }
}
```

**Must own target domain** — Enterprise account must own target email domain.

```json
{
  "error": {
    "message": "Target email domain not owned by this enterprise account",
    "type": "TARGET_EMAIL_DOMAIN_NOT_OWNED_BY_ENTERPRISE"
  }
}
```

**Service accounts must be on verified domains** — A service account email must be on a verified email domain

```json
{
  "error": {
    "message": "Service Account must be on verified enterprise email domain",
    "type": "SERVICE_ACCOUNT_MUST_BE_ON_VERIFIED_DOMAIN"
  }
}
```

**Two factor error** — Email cannot be changed while the user has two factor authentication enabled.

```json
{
  "error": {
    "message": "Cannot change email when two factor authentication is enabled",
    "type": "CANNOT_CHANGE_EMAIL_WHILE_TWO_FACTOR_ENABLED"
  }
}
```