Groups

Update a group

PATCH/groups/{id}
groups:writeupdate_groupIdempotent

Changes the fields you send and returns the group. name and description rename it. lead_user_id names a new lead, who leaves the members; null removes the lead, and is refused with 422 unless a member of your organisations remains. A user who already leads another group returns 409 conflict. parent_id moves the group and its descendants under another group, or to the root with null; moving it under itself or one of its descendants, or under a group you cannot see, returns 422 on parent_id, and a move needs update rights on both groups. features takes { "<flag>": true|false } and changes only the flags it names; turning on user_auto_assign_to_classification classifies the lead and members at once. Callers using a personal token need super admin or multi-accounts, or manage-groups as a member of the group; otherwise 403 missing_permission. A token that acts as its own service identity needs only the groups:write scope. Advisors may change only can_invite_direct_investors and can_be_invited_directly_to_group. dry_run shows the result without saving it. Emits group.updated with the changed fields, and nothing when nothing changed; a new lead who was a member also emits group_member.deleted, and the old and new lead's group classification follows the change. It sends no email. Sending the previous values undoes it.

Path parameters

  • idstring (uuid)Required#

    The group's id, a uuid. An unknown group, or one your organisations cannot see, returns 404.

Query parameters

  • dry_runboolean#

    Validate and run the call without committing it, returning what the real call would return with meta.dry_run set.

Request body

application/json, required · GroupUpdate

  • namestring#

    The new name.

  • descriptionstring | null#

    The new description.

  • lead_user_idstring | null#

    The new lead, or null to remove the lead while a member of your organisations remains.

  • parent_idstring | null#

    The group to move this one under, or null for the root. You need update rights on both groups.

  • featuresobject#

    The feature flags to change, each true or false. Flags you leave out stay as they are.

{
  "name": "Acme Holdings (UK) Ltd",
  "features": {
    "can_be_shown_in_sidebar": true
  }
}

Responses

200

The updated group.

Group
{
  "data": {
    "id": "9a9d1c5e-4f2b-4c8e-9a7d-2f1e6b3c4d5a",
    "name": "string",
    "description": "string",
    "lead_user_id": "9a9d1c5e-4f2b-4c8e-9a7d-2f1e6b3c4d5a",
    "parent_id": "9a9d1c5e-4f2b-4c8e-9a7d-2f1e6b3c4d5a",
    "member_count": 1,
    "features": {
      "users_can_create_new_sub_groups": true,
      "can_be_invited_directly_to_group": true,
      "can_be_shown_in_sidebar": true,
      "user_auto_assign_to_classification": true,
      "can_invite_direct_investors": true
    },
    "created_at": "2026-06-12T10:00:00+00:00",
    "updated_at": "2026-06-12T10:00:00+00:00"
  }
}
401

Authentication failed. error.code is one of invalid_token, expired, revoked.

Error
403

Authorization failed. error.code is missing_permission when the caller may not change the group, with the permissions that would allow it in details, or one of missing_scope, scope_disabled, org_disabled, ip_blocked, user_disabled.

Error
404

Resource not found (error.code = not_found).

Error
409

The request conflicts with existing state (error.code = conflict), e.g. a compliance flow with the requested name already exists.

Error
422

The request can't be processed (HTTP 422): validation_failed with one ErrorDetail per problem, or a code documented on the operation.

Error
429

Rate limit exceeded (error.code = rate_limited).

Error

Examples

curl -X PATCH https://your-org-domain/kong/core/api/v2/groups/{id}\
  -H "Authorization: Bearer $HELM_API_KEY"\
  -H "Content-Type: application/json"\
  -d '{
  "name": "Acme Holdings (UK) Ltd",
  "features": {
    "can_be_shown_in_sidebar": true
  }
}'