# Replace roles

URL: https://docs.hanzo.ai/docs/openapi/iam/put-iam-roles-by-owner-by-name

> Changes who is in a role, or which roles it includes.

`PUT /v1/iam/roles/{owner}/{name}`

> [IAM →](https://docs.hanzo.ai/docs/openapi/iam) · [All API references →](https://docs.hanzo.ai/docs/openapi) · [Get started →](https://docs.hanzo.ai/docs/guides)

|               |                                                    |
| ------------- | -------------------------------------------------- |
| **Address**   | `https://api.hanzo.ai/v1/iam/roles/{owner}/{name}` |
| **Method**    | `PUT`                                              |
| **Operation** | `put_iam_roles_by_owner_by_name`                   |
| **Auth**      | `Authorization: Bearer $HANZO_API_KEY`             |

Changes who is in a role, or which roles it includes. Access changes for
everyone in it as soon as the write lands. What the role is called does not
change, and neither does when it was created.

## Request

12 fields, body `application/json` (required).

| Field         | In   | Type      | Required | Description                                                                                                                    |
| ------------- | ---- | --------- | -------- | ------------------------------------------------------------------------------------------------------------------------------ |
| `owner`       | path | string    | yes      |                                                                                                                                |
| `name`        | path | string    | yes      | Name addresses the team on update and names it on create; every other field is content and binds from the BODY, never the URL. |
| `createdTime` | body | string    | —        |                                                                                                                                |
| `description` | body | string    | —        |                                                                                                                                |
| `displayName` | body | string    | —        |                                                                                                                                |
| `domains`     | body | string\[] | —        |                                                                                                                                |
| `isEnabled`   | body | boolean   | —        |                                                                                                                                |
| `name`        | body | string    | —        | Name addresses the team on update and names it on create; every other field is content and binds from the BODY, never the URL. |
| `owner`       | body | string    | —        |                                                                                                                                |
| `roles`       | body | string\[] | —        |                                                                                                                                |
| `teams`       | body | string\[] | —        |                                                                                                                                |
| `users`       | body | string\[] | —        |                                                                                                                                |

## Response

| Status    | Body            | Meaning           |
| --------- | --------------- | ----------------- |
| `200`     | iam.Role        | ok                |
| `202`     | Approval        | held for approval |
| `default` | problem-details | refused           |

`200` body — 14 fields.

| Field         | In   | Type               | Always | Description |
| ------------- | ---- | ------------------ | ------ | ----------- |
| `createdAt`   | body | string (date-time) | —      |             |
| `createdTime` | body | string             | —      |             |
| `deleted`     | body | boolean            | —      |             |
| `description` | body | string             | —      |             |
| `displayName` | body | string             | —      |             |
| `domains`     | body | string\[]          | —      |             |
| `id`          | body | string             | —      |             |
| `isEnabled`   | body | boolean            | —      |             |
| `name`        | body | string             | —      |             |
| `owner`       | body | string             | —      |             |
| `roles`       | body | string\[]          | —      |             |
| `teams`       | body | string\[]          | —      |             |
| `updatedAt`   | body | string (date-time) | —      |             |
| `users`       | body | string\[]          | —      |             |

Failure carries the platform error shape — see [Errors](https://docs.hanzo.ai/docs/errors).

## Examples

**CLI**

```bash
hanzo iam roles owner set <owner> <name>
```

**SDK**

**.ts**

```ts
import { Configuration, IamApi } from 'hanzoai';

const api = new IamApi(new Configuration({ accessToken: process.env.HANZO_API_KEY }));
const { data } = await api.putIamRolesByOwnerByName({ owner: 'owner', name: 'name', createdTime: "<createdTime>", description: "<description>" });
```

**.py**

```python
from hanzoai.cloud import ApiClient, Configuration
from hanzoai.cloud.api import IamApi

client = ApiClient(Configuration(access_token=os.environ["HANZO_API_KEY"]))
result = IamApi(client).put_iam_roles_by_owner_by_name(owner='owner', name='name', created_time="<createdTime>", description="<description>")
```

**.go**

```go
cfg := hanzoai.NewConfiguration()
cfg.AddDefaultHeader("Authorization", "Bearer "+os.Getenv("HANZO_API_KEY"))
client := hanzoai.NewAPIClient(cfg)

resp, _, err := client.IamAPI.PutIamRolesByOwnerByName(context.Background()).Execute()
if err != nil {
	return err
}
```

**.rs**

```rust
use hanzo_client::apis::{configuration::Configuration, iam_api};

let mut cfg = Configuration::new();
cfg.bearer_access_token = std::env::var("HANZO_API_KEY").ok();

let result = iam_api::put_iam_roles_by_owner_by_name(&cfg, Default::default()).await?;
```

**.java**

```java
import ai.hanzo.cloud.ApiClient;
import ai.hanzo.cloud.api.IamApi;

ApiClient client = new ApiClient();
client.setBearerToken(System.getenv("HANZO_API_KEY"));

var result = new IamApi(client).putIamRolesByOwnerByName();
```

**HTTP**

```bash
curl -X PUT https://api.hanzo.ai/v1/iam/roles/<owner>/<name> \
  -H "Authorization: Bearer $HANZO_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
       "createdTime": "<createdTime>",
       "description": "<description>"
     }'
```

**MCP**

MCP reaches **iam** through the `iam` tool, which names its 44 operations with its own verbs — this one among them, under a name only MCP declares. `describe` explains any of them:

```bash
curl -X POST https://api.hanzo.ai/v1/mcp \
  -H "Content-Type: application/json" \
  -d '{
       "jsonrpc": "2.0",
       "id": 1,
       "method": "tools/call",
       "params": {
         "name": "describe",
         "arguments": {
           "op": "list_iam_applications"
         }
       }
     }'
```

---

[IAM API](https://docs.hanzo.ai/docs/openapi/iam) · [All Hanzo APIs](https://docs.hanzo.ai/docs/openapi) · [Interactive reference](https://docs.hanzo.ai/docs/openapi/reference)