Promote a ApiShare user to tenant owner

This guide provides the necessary steps to promote a user who has logged in at least once to ApiShare to the Tenant Owner role.

Note: The Tenant Admin role is not considered as a service account user.

Prerequisites

• The user has successfully completed the first login to ApiShare and exists both in the IDP and in the ApiShare database.

• The actor performing the request must be a service account user.

Operational Steps

Step 1: Detetemine the userId and roleId

• UserId: Retrieve the UUID of the target uservia the User Management API.

• RoleId: Retrieve the roleId corresponding to the Tenant Admin role via the Permission Management API.

These identifiers will be required in the updateUserRole REST request.

Step 2: Execute the REST API Call

Use the following endpoint to update the role of the target user:

curl --location --request PUT 'https://<domain>/user-management/users/<userId>/roles' \
--header 'requestId: 00000000-0000-0000-0000-000000000000' \
--header 'sessionId: 00000000-0000-0000-0000-000000000000' \
--header 'correlationId: 00000000-0000-0000-0000-000000000000' \
--header 'Authorization: Bearer <jwt>' \
--header 'Content-Type: application/json' \
--data '{
    "roleId": "<tenantAdminRoleId>"
}'

<userId>: UUID of the user to promote.

• <tenantAdminRoleId>: The roleId corresponding to a Tenant Admin role (e.g role 'Owner').

• To remove ownership, set "roleId": null.

Note also that Service accounts cannot be modified.

The service automatically handles the following cases:

• If the user already has a Tenant Admin role → the role is updated.

• If the user is a Guest → the user is promoted to Tenant Admin with the role specified.

• If the user is not a Guest (and not already a Tenant Admin) → the request is rejected.

• If "roleId": null → the Tenant Admin role is removed, and the user return to be a Guest user.

After a successful role update, the system triggers an Elasticsearch index refresh for users and organizations, so that the change is immediately reflected in ApiShare.

Verifications

Login to ApiShare with the promoted user account and verify the assigned role.