Patch User

Description

Partially updates an existing AttackForge user. This is a write operation: it updates the user record, and may also move the user to a different role or block them. Only the keys supplied in args are changed; omitted keys are left untouched.

The shape of args is declared inline (see Building args for Write Tools), so no preparatory call is needed.

Who may patch what:

• Administrators may patch any user and any key.

• Any other caller may patch only their own record, and only the keys not marked Administrators only below. Supplying an administrator-only key is refused rather than silently dropped.

A deleted user cannot be patched. The last remaining active administrator cannot be blocked, expired, or moved off the admin role. On success the patched user id is returned.

How To Enable

1. Go to Users

2. Select the user you would like to provide access to this tool

3. Click on Access > MCP

4. Click on Add Tools

5. Select the tool patch_user and click Add

Example Prompts

• Block Jane Smith's account.

• Unblock user X.

• Make Bob a project operator.

• Set my job title to Senior Penetration Tester and add OSCP to my certifications.

• Force user X to change their password at next login.

• Expire the contractor accounts at the end of the month.

• Clear the account expiry on user X.

• Update the Department custom field on user X to "Security".

Parameters

Parameter	Type	Required	Description
args	object	Yes	The user-patch payload - see the keys below.

args keys:

Key	Type	Required	Description
user_id	string	Yes	Id (24-hex) of the user to patch. Source: find_users. A caller who is not an administrator may only pass their own user id.
first_name	string	No	First name.
last_name	string	No	Last name.
email	string	No	Email address. Must not already be in use by another user. Administrators only.
username	string	No	The username the user signs in with. Must not already be in use by another user. Administrators only.
role	string	No	One of 'admin', 'projectoperator', 'librarymod', 'consultant', 'client'. Every role other than 'client' consumes a user licence, so moving a user off 'client' fails once the licence is exhausted. Moving the only remaining active administrator off 'admin' is refused. Administrators only.
status	string	No	'Active' unblocks the account and clears any expiry; 'Blocked' blocks it and signs the user out of every session. Blocking the only remaining active administrator is refused. Administrators only.
mfa_enabled	boolean	No	Whether multi-factor authentication is required for this user. Administrators only.
force_password_change	boolean	No	Whether the user must change their password at next sign-in. Administrators only.
exempt_global_inactivity_policy	boolean	No	Whether the user is exempt from the global inactivity policy. Administrators only.
account_expiry	string or null	No	ISO-8601 datetime of when the account expires. Pass null to clear an existing expiry; omit to leave it unchanged. Expiring the only remaining active administrator is refused. Administrators only.
job_title	string	No	Profile job title.
organization	string	No	Profile organization.
business_group	string	No	Profile business group.
office_location	string	No	Profile office location.
about_me	string	No	Profile free-text biography.
tags	array	No	String tags on the profile. Replaces the existing tags when supplied.
certifications	array	No	Certifications. Replaces the existing certifications when supplied.
education	array	No	Education history, each { qualification, institute, completed }. Replaces the existing history when supplied.
employment	array	No	Employment history, each { role, company, duration, description }. duration is one of '0+ Years', '1-2 Years', '2-3 Years', '3-5 Years', '5-10 Years', '10+ Years'. Replaces the existing history when supplied.
custom_fields	array	No	Custom field values, each { key, value }. Supplying a custom field replaces its current value; supplying null clears it. Discover keys via get_field_structure(model="user"). A caller who is not an administrator may set these on their own record, subject to the same per-field access.

Supplying status together with account_expiry applies both: 'Active' clears the existing expiry and the supplied account_expiry then sets a new one.

Example Response

{
  "user_id": "65a440c08cade68ca7bc7192"
}