Only the attributes present in the body are updated, so you can send a single field:

{
    "email": "[email protected]"
}

Sending roles replaces the user's roles entirely. As for Create a client user, every role can be assigned and advanced roles do not require the Governance add-on. Setting active to false deactivates the user (see Deactivate a client user); setting it back to true reactivates them.

Unlike Update a user, you can change the email of a super admin, and of a user whose company enforces SSO. The user's previous SSO identity is cleared: they sign in again with the new address.

The company-level rules still apply: you cannot remove the last active super admin of the client company, nor leave it without a single active paying license.

📘

Requires the write_clients permission scope on the API key of a reseller account.

❗️

A company that is not one of your clients, including your own reseller company, answers 404.