You can use the PUT /environments/{environmentId}/users/{userId} operation to update existing attribute properties. For PUT requests, the update operation removes any existing attribute property values omitted from the request body.

The recommended way to construct a PUT request is to perform a GET first and then use the response body to construct the PUT request body with your property value modifications.

The response data shows the updates for all attribute values specified in the request body.

Users who are not authenticating with PingOne must be assigned an identity provider with the identityProvider.id attribute. If identityProvider.id is not provided, PingOne is set as the default identity provider. The identityProvider.type value is read-only, and its value is dependent on the value of identityProvider.id. If identityProvider.id is not provided, the default value of identityProvider.type is PING_ONE.

Important: Users who authenticate with an authoritative identity provider cannot self-service modify their account. Their user.identityProvider.id attribute is not null and their user.identityProvider.type attribute is not PING_ONE.

Note: If the user does not have update access to an attribute, a 403 Forbidden error is returned if an update is attempted for that attribute.

Note: You can enable multi-factor authentication by setting mfaEnabled to true with POST CREATE User, POST CREATE User (Import), or PUT UPDATE User MFA Enabled. You cannot update mfaEnabled with PUT UPDATE User or PATCH UPDATE User.