Toggle a user's admin flag (admin only).

PATCH

/api/admin/users/{id}/admin

const url = 'https://api.tradr.cloud/api/admin/users/2489E9AD-2EE2-8E00-8EC9-32D5F69181C0/admin';
const options = {
  method: 'PATCH',
  headers: {'Content-Type': 'application/json'},
  body: '{"isAdmin":true}'
};

try {
  const response = await fetch(url, options);
  const data = await response.json();
  console.log(data);
} catch (error) {
  console.error(error);
}

curl --request PATCH \
  --url https://api.tradr.cloud/api/admin/users/2489E9AD-2EE2-8E00-8EC9-32D5F69181C0/admin \
  --header 'Content-Type: application/json' \
  --data '{ "isAdmin": true }'

Admin-gated (403 ADMIN_REQUIRED). The admin surface’s single write — PATCH (never GET) per the SameSite=Lax CSRF posture (REQ-3.3). Body { isAdmin }. Race-safe inside one transaction with a same-tx audit row: demoting the last remaining admin is refused with a 409 LAST_ADMIN (“Cannot remove the last admin”), so the instance can never reach zero admins through the API. Self-demotion is permitted when not the last admin. Toggling to the current value is a 200 no-op (no update, no audit row). Returns the target’s { id, email, isAdmin, createdAt }.

Parameters

Path Parameters

required

string format: uuid

Request Body^required

application/json

object

isAdmin

required

boolean

Example^generated

{
  "isAdmin": true
}

Responses

200

{ id, email, isAdmin, createdAt } — the post-toggle target.

400

VALIDATION_ERROR — id is not a UUID or body is malformed.

401

Not authenticated.

403

ADMIN_REQUIRED — authenticated but not an admin.

404

NOT_FOUND — no such user.

409

LAST_ADMIN — cannot remove the last admin.

429

Admin rate limit reached (60 / 60 s per user).