> ## Documentation Index > Fetch the complete documentation index at: https://api.buildingswell.com/llms.txt > Use this file to discover all available pages before exploring further. # Update many users > Apply one set of changes to every user matching your filter. The filter must be in the **query string**. A filter in the body is ignored, and a request with no filter is rejected with `400` so you cannot update the whole table by accident. ## OpenAPI ````yaml /openapi.yaml patch /organization-member/bulk openapi: 3.0.3 info: title: BuildingSwell Public API version: 2.0.0 description: > The BuildingSwell v2 public API. Every request needs an `X-API-Key` header, and every key is scoped to one organization, so you only ever see your own data. Base URL: `https://app.buildingswell.com/api/v2` Most resources share the same CRUD and query shape. Read the [standard endpoints](/guides/standard-endpoints) and [querying](/guides/querying) guides once and the rest of this reference follows the same rules. For what a delete actually removes, see [archiving and deleting](/guides/archiving-and-deleting). servers: - url: https://{instance}/api/v2 description: Your BuildingSwell instance variables: instance: default: app.buildingswell.com description: Your BuildingSwell host security: - ApiKeyAuth: [] tags: - name: Projects description: Customer jobs, and the archive behavior they share with most resources. - name: Stages description: Reusable shop stations, scoped to a department. - name: Deliverables description: >- The work tree: orders, routes, phases, components, stages, steps, and QC steps. - name: Work sessions description: Time logged by one person against one deliverable. - name: Dependencies description: Scheduling links between deliverables. - name: Documents description: Files attached to orders. - name: QC description: QC templates and the inspection sets filled from them. - name: People (Workers) description: Your workforce roster. Called People in the app and `worker` in the API. - name: Timesheets description: Read-only view over attendance and work sessions. - name: Codes description: Cost, union, and per diem code lists. Referenced by value, not by id. - name: Roles description: Permission roles, and the statements that make them up. - name: Users description: >- People with a BuildingSwell login. Called Users in the app and `organization-member` in the API. - name: Concepts description: Deliverable writes with the nesting rules enforced. - name: Items description: Material and part definitions, purchasing units, and availability. - name: Item vendors description: Supplier SKUs linked to items. - name: Inventory stock description: Read-only quantities by item and location. - name: Inventory transactions description: The inventory ledger and its posting rules. - name: Inventory allocations description: Read-only reservations for orders and projects. - name: BOM lines description: Planned material inputs for routes, orders, and projects. - name: Production outputs description: Declarations of manufactured outputs. - name: Units of measure description: Reusable names and abbreviations for quantities. - name: Vendors description: Suppliers, manufacturers, and subcontractors. - name: Locations description: Department and project locations for storage and delivery. - name: Deliveries description: Inbound receipts, outbound trips, and transfers. - name: Delivery lines description: Material and ad-hoc manifest lines. - name: Trucks description: Fleet vehicles and their capacity. - name: Contacts description: Drivers, receivers, and other business contacts. - name: Project contacts description: Links between projects and contacts. - name: Teams description: Read-only department teams. - name: Shifts description: Read-only department shifts. - name: Departments (shops) description: Read-only departments, called shops in the API. - name: Custom properties description: Organization property definitions and values on orders. paths: /organization-member/bulk: patch: tags: - Users summary: Update many users description: >- Apply one set of changes to every user matching your filter. The filter must be in the **query string**. A filter in the body is ignored, and a request with no filter is rejected with `400` so you cannot update the whole table by accident. parameters: - $ref: '#/components/parameters/search' - $ref: '#/components/parameters/filter' requestBody: required: true content: application/json: schema: $ref: '#/components/schemas/OrganizationMemberUpdate' responses: '200': description: The updated users. content: application/json: schema: $ref: '#/components/schemas/OrganizationMemberMultiResponse' '400': $ref: '#/components/responses/BadRequest' '401': $ref: '#/components/responses/Unauthorized' '403': $ref: '#/components/responses/Forbidden' '409': $ref: '#/components/responses/Conflict' '429': $ref: '#/components/responses/RateLimited' components: parameters: search: name: search in: query description: >- Full-text search across the resource's search columns. Append `:col1,col2` to limit which columns are searched. schema: type: string example: warehouse filter: name: filter in: query description: >- AND/OR filter expression, for example `type eq 'phase' and isArchived eq false`. Simple equality can also be passed as plain field parameters. schema: type: string example: isArchived eq false schemas: OrganizationMemberUpdate: type: object description: >- Every field is optional. Only the fields you send are changed. `email` is not updatable: it identifies the login and is owned by the identity provider. properties: name: type: string minLength: 1 description: >- Display name. Written to the linked user account, so it comes back as `appUser.name` rather than on the membership. roleId: type: string format: uuid description: Role the user carries. nullable: true roleType: type: string enum: - admin - custom description: '`admin` grants everything. `custom` follows `roleId`.' default: custom workerId: type: string format: uuid description: >- Person record to link this user to. Pass `null` to unlink. Write-only — it is stored on the person, not on the membership. nullable: true OrganizationMemberMultiResponse: type: object properties: values: type: array items: $ref: '#/components/schemas/OrganizationMember' required: - values OrganizationMember: type: object description: >- A user account's membership in your organization, including the role it carries. properties: id: type: string format: uuid description: Unique id of the membership. organizationId: type: string format: uuid description: >- Your organization. Taken from the API key, never from the request body. appUserId: type: string format: uuid description: The user account behind this membership. roleId: type: string format: uuid description: Role the user carries. nullable: true roleType: type: string enum: - admin - custom description: '`admin` grants everything. `custom` follows `roleId`.' default: custom status: type: string enum: - active - deactivated description: Whether the user can sign in. default: active appUser: type: object description: >- Fields joined from the user account. Read-only here, and searchable as `appUser.name` and `appUser.email`. properties: email: type: string format: email description: Sign-in email. name: type: string description: Display name. status: type: string enum: - pending - verified description: '`pending` until the user accepts the invite.' isApiKey: type: boolean description: '`true` for the synthetic account behind an API key.' createdAt: type: string format: date-time description: When the record was created. updatedAt: type: string format: date-time description: When the record last changed. Error: type: object properties: error: type: object properties: message: type: string description: What went wrong, in plain language. code: type: string enum: - BAD_REQUEST - UNAUTHORIZED - FORBIDDEN - NOT_FOUND - CONFLICT - VALIDATION - UNIQUE_VIOLATION - FK_VIOLATION - RATE_LIMITED - INTERNAL description: >- Stable machine-readable code. Branch on this rather than on the message text. requestId: type: string description: Id for this request. Quote it when you contact support. details: type: array items: type: object description: One field-level problem. properties: path: type: string description: Field that failed, for example `data.stageId`. message: type: string description: Why it failed. code: type: string description: Validation code. description: Per-field problems. Present on validation failures only. missingPermissions: type: array items: type: string description: Permission name. description: Permissions your key is missing. Present on `403` only. context: type: object description: Extra context for the error. Usually empty. additionalProperties: true responses: BadRequest: description: >- The request was malformed or failed validation. Check `error.details` for the fields at fault. content: application/json: schema: $ref: '#/components/schemas/Error' Unauthorized: description: The `X-API-Key` header is missing or the key is invalid. content: application/json: schema: $ref: '#/components/schemas/Error' Forbidden: description: >- Your key lacks the permission for this call. `error.missingPermissions` lists what is needed. content: application/json: schema: $ref: '#/components/schemas/Error' Conflict: description: >- The write conflicts with existing data: a duplicate unique value (`UNIQUE_VIOLATION`), or a related record that blocks it (`FK_VIOLATION`). content: application/json: schema: $ref: '#/components/schemas/Error' RateLimited: description: >- Too many requests. Read `RateLimit-Reset` for when to retry. This response also carries a top-level `message` alongside `error`. content: application/json: schema: $ref: '#/components/schemas/Error' securitySchemes: ApiKeyAuth: type: apiKey in: header name: X-API-Key description: >- Organization-scoped API key. Create one in the BuildingSwell app under Organization settings, API keys. ````