MongoDB Database Users API
Returns, adds, edits, and removes database users.
Work with this as data
Every API here is available over the APIs.io API and to AI agents over MCP.
MCP server
One button, every client — Claude, Cursor, VS Code and the rest.
https://apis.io/mcp
Tools for apis
7 MCP tools reach this
find_apisBrowse and filter every API in the catalog.get_api_artifactsOne API's artifacts, grouped by type.get_openapiThe primary OpenAPI for this API.find_similar_apisAPIs that look like this one.apis_io_searchSTART HERE — APIs, providers and tags for one query, each with its total.resolveTurn a domain, URL or GitHub org into the provider it belongs to.find_cohortsEvery scored population of providers in the catalog.
Call it yourself
curl for this page
This API
curl "https://apis.io/api/v1/apis/mongodb-database-users-api"
All apis
curl "https://apis.io/api/v1/apis?limit=25"Discovery needs no key. Ratings and market analysis are Pro.
Get an API key
Free tier, no form to fill in. Signing in shares your email address with us — we store it to create your key and to recognise you if you sign in with another provider. See our Privacy Policy and Terms.
A second provider on the same verified email joins the account you already have.
OpenAPI Specification
openapi: 3.2.0
info:
description: "The MongoDB Atlas Administration API allows developers to manage all components in MongoDB Atlas.\n\nThe Atlas Administration API supports OAuth2 Service Accounts and HTTP Digest-based API keys. Service accounts are the recommended authentication method and API keys are considered a legacy option.\n\nTo authenticate with a Service Account, first exchange its client ID and secret for an access token using the OAuth 2.0 Client Credentials flow. Atlas provides a token endpoint at `POST https://cloud.mongodb.com/api/oauth/token`, which returns a Bearer token that is reusable and valid for 1 hour (3600 seconds).\n\nFor example, to [return a list of your organizations](https://www.mongodb.com/docs/api/doc/atlas-admin-api-v2/operation/operation-listorgs) with [cURL](https://en.wikipedia.org/wiki/CURL), first generate an access token and then use that token to call the same Atlas Administration API endpoint shown in the current example:\n\n```\nACCESS_TOKEN=$(curl -fsS --request POST https://cloud.mongodb.com/api/oauth/token \\\n --header \"Authorization: Basic $(printf '%s' \"${CLIENT_ID}:${CLIENT_SECRET}\" | base64 | tr -d '\\n')\" \\\n --header \"Content-Type: application/x-www-form-urlencoded\" \\\n --header \"Accept: application/json\" \\\n --data \"grant_type=client_credentials\" | jq -r '.access_token')\n\ncurl --header \"Authorization: Bearer ${ACCESS_TOKEN}\" \\\n --header \"Accept: application/vnd.atlas.2025-03-12+json\" \\\n -X GET \"https://cloud.mongodb.com/api/atlas/v2/orgs?pretty=true\"\n```\n\nIf your organization requires an IP access list for the Atlas Administration API, the token can be created from any IP address, but the API call that uses the token must originate from an allowed IP.\n\nTo learn more, see [Get Started with the Atlas Administration API](https://www.mongodb.com/docs/atlas/configure-api-access/). For support, see [MongoDB Support](https://www.mongodb.com/support/get-started).\n\nYou can also explore the various endpoints available through the Atlas Administration API in MongoDB's [Postman workspace](https://www.postman.com/mongodb-devrel/workspace/mongodb-atlas-administration-apis/) (requires a Postman account)."
license:
name: CC BY-NC-SA 3.0 US
url: https://creativecommons.org/licenses/by-nc-sa/3.0/us/
termsOfService: https://www.mongodb.com/mongodb-management-service-terms-and-conditions
title: MongoDB Atlas Administration Access Tracking Database Users API
version: '2.0'
x-xgen-sha: 3d70e065843c008b9871ea7836c98c9de6f202f9
servers:
- url: https://cloud.mongodb.com
security:
- ServiceAccounts: []
- DigestAuth: []
tags:
- description: Returns, adds, edits, and removes database users.
name: Database Users
paths:
/api/atlas/v2/groups/{groupId}/databaseUsers:
get:
description: Returns all database users that belong to the specified project. To use this resource, the requesting Service Account or API Key must have the Project Read Only role.
operationId: listGroupDatabaseUsers
parameters:
- $ref: '#/components/parameters/envelope'
- $ref: '#/components/parameters/groupId'
- $ref: '#/components/parameters/includeCount'
- $ref: '#/components/parameters/itemsPerPage'
- $ref: '#/components/parameters/pageNum'
- $ref: '#/components/parameters/pretty'
responses:
'200':
content:
application/vnd.atlas.2023-01-01+json:
schema:
$ref: '#/components/schemas/PaginatedApiAtlasDatabaseUserView'
x-xgen-version: '2023-01-01'
description: OK
headers:
RateLimit-Limit:
$ref: '#/components/headers/HeaderRateLimitLimit'
RateLimit-Remaining:
$ref: '#/components/headers/HeaderRateLimitRemaining'
'401':
$ref: '#/components/responses/unauthorized'
'403':
$ref: '#/components/responses/forbidden'
'404':
$ref: '#/components/responses/notFound'
'429':
$ref: '#/components/responses/tooManyRequests'
'500':
$ref: '#/components/responses/internalServerError'
summary: Return All Database Users in One Project
tags:
- Database Users
x-codeSamples:
- lang: cURL
label: Atlas CLI
source: atlas api databaseUsers listDatabaseUsers --help
- lang: go
label: Go
source: "import (\n\t\"os\"\n\t\"context\"\n\t\"log\"\n\tsdk \"go.mongodb.org/atlas-sdk/v20250312001/admin\"\n)\n\nfunc main() {\n\tctx := context.Background()\n\tclientID := os.Getenv(\"MONGODB_ATLAS_CLIENT_ID\")\n\tclientSecret := os.Getenv(\"MONGODB_ATLAS_CLIENT_SECRET\")\n\n\t// See https://dochub.mongodb.org/core/atlas-go-sdk-oauth\n\tclient, err := sdk.NewClient(sdk.UseOAuthAuth(clientID, clientSecret))\n\n\tif err != nil {\n\t\tlog.Fatalf(\"Error: %v\", err)\n\t}\n\n\tparams = &sdk.ListGroupDatabaseUsersApiParams{}\n\tsdkResp, httpResp, err := client.DatabaseUsersApi.\n\t\tListGroupDatabaseUsersWithParams(ctx, params).\n\t\tExecute()\n}\n"
- lang: cURL
label: curl (Service Accounts)
source: "curl --include --header \"Authorization: Bearer ${ACCESS_TOKEN}\" \\\n --header \"Accept: application/vnd.atlas.2025-03-12+json\" \\\n -X GET \"https://cloud.mongodb.com/api/atlas/v2/groups/{groupId}/databaseUsers?pretty=true\""
- lang: cURL
label: curl (Digest)
source: "curl --user \"${PUBLIC_KEY}:${PRIVATE_KEY}\" \\\n --digest --include \\\n --header \"Accept: application/vnd.atlas.2025-03-12+json\" \\\n -X GET \"https://cloud.mongodb.com/api/atlas/v2/groups/{groupId}/databaseUsers?pretty=true\""
x-rolesRequirements:
- Project Read Only
x-xgen-docs-url: https://mongodb.com/docs/atlas/reference/api-resources-spec/v2/#tag/Database-Users/operation/listGroupDatabaseUsers
x-xgen-operation-id-override: listDatabaseUsers
post:
description: Creates one database user in the specified project. This MongoDB Cloud supports a maximum of 100 database users per project. If you require more than 100 database users on a project, contact Support. To use this resource, the requesting Service Account or API Key must have the Project Owner role, the Project Charts Admin role, Project Stream Processing Owner role, or the Project Database Access Admin role.
externalDocs:
description: Contact MongoDB Support
url: https://cloud.mongodb.com/support
operationId: createGroupDatabaseUser
parameters:
- $ref: '#/components/parameters/envelope'
- $ref: '#/components/parameters/groupId'
- $ref: '#/components/parameters/pretty'
requestBody:
content:
application/vnd.atlas.2023-01-01+json:
examples:
AWS IAM Authentication:
description: AWS IAM Authentication
value:
awsIAMType: USER
databaseName: $external
groupId: 32b6e34b3d91647abb20e7b8
roles:
- databaseName: sales
roleName: readWrite
- databaseName: marketing
roleName: read
scopes:
- name: myCluster
type: CLUSTER
username: arn:aws:iam::358363220050:user/mongodb-aws-iam-auth-test-user
LDAP Authentication:
description: LDAP Authentication
value:
databaseName: admin
groupId: 32b6e34b3d91647abb20e7b8
ldapAuthType: GROUP
roles:
- databaseName: sales
roleName: readWrite
- databaseName: marketing
roleName: read
scopes:
- name: myCluster
type: CLUSTER
username: CN=marketing,OU=groups,DC=example,DC=com
OIDC Workforce Federated Authentication:
description: OIDC Workforce Federated Authentication
value:
databaseName: admin
groupId: 32b6e34b3d91647abb20e7b8
oidcAuthType: IDP_GROUP
roles:
- databaseName: sales
roleName: readWrite
- databaseName: marketing
roleName: read
scopes:
- name: myCluster
type: CLUSTER
username: 5dd7496c7a3e5a648454341c/sales
OIDC Workload Federated Authentication:
description: OIDC Workload Federated Authentication
value:
databaseName: $external
groupId: 32b6e34b3d91647abb20e7b8
oidcAuthType: USER
roles:
- databaseName: sales
roleName: readWrite
- databaseName: marketing
roleName: read
scopes:
- name: myCluster
type: CLUSTER
username: 5dd7496c7a3e5a648454341c/sales
SCRAM-SHA Authentication:
description: SCRAM-SHA Authentication
value:
databaseName: admin
groupId: 32b6e34b3d91647abb20e7b8
password: changeme123
roles:
- databaseName: sales
roleName: readWrite
- databaseName: marketing
roleName: read
scopes:
- name: myCluster
type: CLUSTER
username: david
X509 Authentication:
description: X509 Authentication
value:
databaseName: $external
groupId: 32b6e34b3d91647abb20e7b8
roles:
- databaseName: sales
roleName: readWrite
- databaseName: marketing
roleName: read
scopes:
- name: myCluster
type: CLUSTER
username: CN=david@example.com,OU=users,DC=example,DC=com
x509Type: CUSTOMER
schema:
$ref: '#/components/schemas/CloudDatabaseUser'
description: Creates one database user in the specified project.
required: true
responses:
'201':
content:
application/vnd.atlas.2023-01-01+json:
schema:
$ref: '#/components/schemas/CloudDatabaseUser'
x-xgen-version: '2023-01-01'
description: OK
headers:
RateLimit-Limit:
$ref: '#/components/headers/HeaderRateLimitLimit'
RateLimit-Remaining:
$ref: '#/components/headers/HeaderRateLimitRemaining'
'400':
$ref: '#/components/responses/badRequest'
'401':
$ref: '#/components/responses/unauthorized'
'403':
$ref: '#/components/responses/forbidden'
'404':
$ref: '#/components/responses/notFound'
'409':
$ref: '#/components/responses/conflict'
'429':
$ref: '#/components/responses/tooManyRequests'
'500':
$ref: '#/components/responses/internalServerError'
summary: Create One Database User in One Project
tags:
- Database Users
x-codeSamples:
- lang: cURL
label: Atlas CLI
source: atlas api databaseUsers createDatabaseUser --help
- lang: go
label: Go
source: "import (\n\t\"os\"\n\t\"context\"\n\t\"log\"\n\tsdk \"go.mongodb.org/atlas-sdk/v20250312001/admin\"\n)\n\nfunc main() {\n\tctx := context.Background()\n\tclientID := os.Getenv(\"MONGODB_ATLAS_CLIENT_ID\")\n\tclientSecret := os.Getenv(\"MONGODB_ATLAS_CLIENT_SECRET\")\n\n\t// See https://dochub.mongodb.org/core/atlas-go-sdk-oauth\n\tclient, err := sdk.NewClient(sdk.UseOAuthAuth(clientID, clientSecret))\n\n\tif err != nil {\n\t\tlog.Fatalf(\"Error: %v\", err)\n\t}\n\n\tparams = &sdk.CreateGroupDatabaseUserApiParams{}\n\tsdkResp, httpResp, err := client.DatabaseUsersApi.\n\t\tCreateGroupDatabaseUserWithParams(ctx, params).\n\t\tExecute()\n}\n"
- lang: cURL
label: curl (Service Accounts)
source: "curl --include --header \"Authorization: Bearer ${ACCESS_TOKEN}\" \\\n --header \"Accept: application/vnd.atlas.2025-03-12+json\" \\\n --header \"Content-Type: application/json\" \\\n -X POST \"https://cloud.mongodb.com/api/atlas/v2/groups/{groupId}/databaseUsers\" \\\n -d '{ <Payload> }'"
- lang: cURL
label: curl (Digest)
source: "curl --user \"${PUBLIC_KEY}:${PRIVATE_KEY}\" \\\n --digest --include \\\n --header \"Accept: application/vnd.atlas.2025-03-12+json\" \\\n --header \"Content-Type: application/json\" \\\n -X POST \"https://cloud.mongodb.com/api/atlas/v2/groups/{groupId}/databaseUsers\" \\\n -d '{ <Payload> }'"
x-rolesRequirements:
- Project Database Access Admin
- Project Stream Processing Owner
x-xgen-docs-url: https://mongodb.com/docs/atlas/reference/api-resources-spec/v2/#tag/Database-Users/operation/createGroupDatabaseUser
x-xgen-operation-id-override: createDatabaseUser
/api/atlas/v2/groups/{groupId}/databaseUsers/{databaseName}/{username}:
delete:
description: Removes one database user from the specified project. To use this resource, the requesting Service Account or API Key must have the Project Owner role, the Project Stream Processing Owner role, or the Project Database Access Admin role.
operationId: deleteGroupDatabaseUser
parameters:
- $ref: '#/components/parameters/envelope'
- $ref: '#/components/parameters/groupId'
- $ref: '#/components/parameters/pretty'
- description: The database against which the database user authenticates. Database users must provide both a username and authentication database to log into MongoDB. If the user authenticates with AWS IAM, x.509, LDAP, or OIDC Workload this value should be `$external`. If the user authenticates with SCRAM-SHA or OIDC Workforce, this value should be `admin`.
in: path
name: databaseName
required: true
schema:
type: string
- description: 'Human-readable label that represents the user that authenticates to MongoDB. The format of this label depends on the method of authentication:
| Authentication Method | Parameter Needed | Parameter Value | username Format |
|---|---|---|---|
| AWS IAM | `awsIAMType` | `ROLE` | <abbr title="Amazon Resource Name">ARN</abbr> |
| AWS IAM | `awsIAMType` | `USER` | <abbr title="Amazon Resource Name">ARN</abbr> |
| x.509 | `x509Type` | `CUSTOMER` | [RFC 2253](https://tools.ietf.org/html/2253) Distinguished Name |
| x.509 | `x509Type` | `MANAGED` | [RFC 2253](https://tools.ietf.org/html/2253) Distinguished Name |
| LDAP | `ldapAuthType` | `USER` | [RFC 2253](https://tools.ietf.org/html/2253) Distinguished Name |
| LDAP | `ldapAuthType` | `GROUP` | [RFC 2253](https://tools.ietf.org/html/2253) Distinguished Name |
| OIDC Workforce | `oidcAuthType` | `IDP_GROUP` | Atlas OIDC IdP ID (found in federation settings), followed by a ''/'', followed by the IdP group name |
| OIDC Workload | `oidcAuthType` | `USER` | Atlas OIDC IdP ID (found in federation settings), followed by a ''/'', followed by the IdP user name |
| SCRAM-SHA | `awsIAMType`, `x509Type`, `ldapAuthType`, `oidcAuthType` | `NONE` | Alphanumeric string |
'
in: path
name: username
required: true
schema:
example: 'SCRAM-SHA: dylan or AWS IAM: arn:aws:iam::123456789012:user/sales/enterprise/DylanBloggs or x.509/LDAP: CN=Dylan Bloggs,OU=Enterprise,OU=Sales,DC=Example,DC=COM or OIDC: IdPIdentifier/IdPGroupName'
type: string
responses:
'204':
content:
application/vnd.atlas.2023-01-01+json:
x-xgen-version: '2023-01-01'
description: This endpoint does not return a response body.
headers:
RateLimit-Limit:
$ref: '#/components/headers/HeaderRateLimitLimit'
RateLimit-Remaining:
$ref: '#/components/headers/HeaderRateLimitRemaining'
'401':
$ref: '#/components/responses/unauthorized'
'403':
$ref: '#/components/responses/forbidden'
'404':
$ref: '#/components/responses/notFound'
'429':
$ref: '#/components/responses/tooManyRequests'
'500':
$ref: '#/components/responses/internalServerError'
summary: Remove One Database User from One Project
tags:
- Database Users
x-codeSamples:
- lang: cURL
label: Atlas CLI
source: atlas api databaseUsers deleteDatabaseUser --help
- lang: go
label: Go
source: "import (\n\t\"os\"\n\t\"context\"\n\t\"log\"\n\tsdk \"go.mongodb.org/atlas-sdk/v20250312001/admin\"\n)\n\nfunc main() {\n\tctx := context.Background()\n\tclientID := os.Getenv(\"MONGODB_ATLAS_CLIENT_ID\")\n\tclientSecret := os.Getenv(\"MONGODB_ATLAS_CLIENT_SECRET\")\n\n\t// See https://dochub.mongodb.org/core/atlas-go-sdk-oauth\n\tclient, err := sdk.NewClient(sdk.UseOAuthAuth(clientID, clientSecret))\n\n\tif err != nil {\n\t\tlog.Fatalf(\"Error: %v\", err)\n\t}\n\n\tparams = &sdk.DeleteGroupDatabaseUserApiParams{}\n\thttpResp, err := client.DatabaseUsersApi.\n\t\tDeleteGroupDatabaseUserWithParams(ctx, params).\n\t\tExecute()\n}\n"
- lang: cURL
label: curl (Service Accounts)
source: "curl --include --header \"Authorization: Bearer ${ACCESS_TOKEN}\" \\\n --header \"Accept: application/vnd.atlas.2025-03-12+json\" \\\n -X DELETE \"https://cloud.mongodb.com/api/atlas/v2/groups/{groupId}/databaseUsers/{databaseName}/{username}\""
- lang: cURL
label: curl (Digest)
source: "curl --user \"${PUBLIC_KEY}:${PRIVATE_KEY}\" \\\n --digest --include \\\n --header \"Accept: application/vnd.atlas.2025-03-12+json\" \\\n -X DELETE \"https://cloud.mongodb.com/api/atlas/v2/groups/{groupId}/databaseUsers/{databaseName}/{username}\""
x-rolesRequirements:
- Project Database Access Admin
- Project Stream Processing Owner
x-xgen-docs-url: https://mongodb.com/docs/atlas/reference/api-resources-spec/v2/#tag/Database-Users/operation/deleteGroupDatabaseUser
x-xgen-operation-id-override: deleteDatabaseUser
get:
description: Returns one database user that belong to the specified project. To use this resource, the requesting Service Account or API Key must have the Project Read Only role.
operationId: getGroupDatabaseUser
parameters:
- $ref: '#/components/parameters/envelope'
- $ref: '#/components/parameters/groupId'
- $ref: '#/components/parameters/pretty'
- description: The database against which the database user authenticates. Database users must provide both a username and authentication database to log into MongoDB. If the user authenticates with AWS IAM, x.509, LDAP, or OIDC Workload this value should be `$external`. If the user authenticates with SCRAM-SHA or OIDC Workforce, this value should be `admin`.
in: path
name: databaseName
required: true
schema:
type: string
- description: 'Human-readable label that represents the user that authenticates to MongoDB. The format of this label depends on the method of authentication:
| Authentication Method | Parameter Needed | Parameter Value | username Format |
|---|---|---|---|
| AWS IAM | `awsIAMType` | `ROLE` | <abbr title="Amazon Resource Name">ARN</abbr> |
| AWS IAM | `awsIAMType` | `USER` | <abbr title="Amazon Resource Name">ARN</abbr> |
| x.509 | `x509Type` | `CUSTOMER` | [RFC 2253](https://tools.ietf.org/html/2253) Distinguished Name |
| x.509 | `x509Type` | `MANAGED` | [RFC 2253](https://tools.ietf.org/html/2253) Distinguished Name |
| LDAP | `ldapAuthType` | `USER` | [RFC 2253](https://tools.ietf.org/html/2253) Distinguished Name |
| LDAP | `ldapAuthType` | `GROUP` | [RFC 2253](https://tools.ietf.org/html/2253) Distinguished Name |
| OIDC Workforce | `oidcAuthType` | `IDP_GROUP` | Atlas OIDC IdP ID (found in federation settings), followed by a ''/'', followed by the IdP group name |
| OIDC Workload | `oidcAuthType` | `USER` | Atlas OIDC IdP ID (found in federation settings), followed by a ''/'', followed by the IdP user name |
| SCRAM-SHA | `awsIAMType`, `x509Type`, `ldapAuthType`, `oidcAuthType` | `NONE` | Alphanumeric string |
'
in: path
name: username
required: true
schema:
example: 'SCRAM-SHA: dylan or AWS IAM: arn:aws:iam::123456789012:user/sales/enterprise/DylanBloggs or x.509/LDAP: CN=Dylan Bloggs,OU=Enterprise,OU=Sales,DC=Example,DC=COM or OIDC: IdPIdentifier/IdPGroupName'
type: string
responses:
'200':
content:
application/vnd.atlas.2023-01-01+json:
schema:
$ref: '#/components/schemas/CloudDatabaseUser'
x-xgen-version: '2023-01-01'
description: OK
headers:
RateLimit-Limit:
$ref: '#/components/headers/HeaderRateLimitLimit'
RateLimit-Remaining:
$ref: '#/components/headers/HeaderRateLimitRemaining'
'401':
$ref: '#/components/responses/unauthorized'
'403':
$ref: '#/components/responses/forbidden'
'404':
$ref: '#/components/responses/notFound'
'429':
$ref: '#/components/responses/tooManyRequests'
'500':
$ref: '#/components/responses/internalServerError'
summary: Return One Database User from One Project
tags:
- Database Users
x-codeSamples:
- lang: cURL
label: Atlas CLI
source: atlas api databaseUsers getDatabaseUser --help
- lang: go
label: Go
source: "import (\n\t\"os\"\n\t\"context\"\n\t\"log\"\n\tsdk \"go.mongodb.org/atlas-sdk/v20250312001/admin\"\n)\n\nfunc main() {\n\tctx := context.Background()\n\tclientID := os.Getenv(\"MONGODB_ATLAS_CLIENT_ID\")\n\tclientSecret := os.Getenv(\"MONGODB_ATLAS_CLIENT_SECRET\")\n\n\t// See https://dochub.mongodb.org/core/atlas-go-sdk-oauth\n\tclient, err := sdk.NewClient(sdk.UseOAuthAuth(clientID, clientSecret))\n\n\tif err != nil {\n\t\tlog.Fatalf(\"Error: %v\", err)\n\t}\n\n\tparams = &sdk.GetGroupDatabaseUserApiParams{}\n\tsdkResp, httpResp, err := client.DatabaseUsersApi.\n\t\tGetGroupDatabaseUserWithParams(ctx, params).\n\t\tExecute()\n}\n"
- lang: cURL
label: curl (Service Accounts)
source: "curl --include --header \"Authorization: Bearer ${ACCESS_TOKEN}\" \\\n --header \"Accept: application/vnd.atlas.2025-03-12+json\" \\\n -X GET \"https://cloud.mongodb.com/api/atlas/v2/groups/{groupId}/databaseUsers/{databaseName}/{username}?pretty=true\""
- lang: cURL
label: curl (Digest)
source: "curl --user \"${PUBLIC_KEY}:${PRIVATE_KEY}\" \\\n --digest --include \\\n --header \"Accept: application/vnd.atlas.2025-03-12+json\" \\\n -X GET \"https://cloud.mongodb.com/api/atlas/v2/groups/{groupId}/databaseUsers/{databaseName}/{username}?pretty=true\""
x-rolesRequirements:
- Project Read Only
x-xgen-docs-url: https://mongodb.com/docs/atlas/reference/api-resources-spec/v2/#tag/Database-Users/operation/getGroupDatabaseUser
x-xgen-operation-id-override: getDatabaseUser
patch:
description: Updates one database user that belongs to the specified project. To use this resource, the requesting Service Account or API Key must have the Project Owner role, Project Charts Admin role, Project Stream Processing Owner role, or the Project Database Access Admin role.
operationId: updateGroupDatabaseUser
parameters:
- $ref: '#/components/parameters/envelope'
- $ref: '#/components/parameters/groupId'
- $ref: '#/components/parameters/pretty'
- description: The database against which the database user authenticates. Database users must provide both a username and authentication database to log into MongoDB. If the user authenticates with AWS IAM, x.509, LDAP, or OIDC Workload this value should be `$external`. If the user authenticates with SCRAM-SHA or OIDC Workforce, this value should be `admin`.
in: path
name: databaseName
required: true
schema:
type: string
- description: 'Human-readable label that represents the user that authenticates to MongoDB. The format of this label depends on the method of authentication:
| Authentication Method | Parameter Needed | Parameter Value | username Format |
|---|---|---|---|
| AWS IAM | `awsIAMType` | `ROLE` | <abbr title="Amazon Resource Name">ARN</abbr> |
| AWS IAM | `awsIAMType` | `USER` | <abbr title="Amazon Resource Name">ARN</abbr> |
| x.509 | `x509Type` | `CUSTOMER` | [RFC 2253](https://tools.ietf.org/html/2253) Distinguished Name |
| x.509 | `x509Type` | `MANAGED` | [RFC 2253](https://tools.ietf.org/html/2253) Distinguished Name |
| LDAP | `ldapAuthType` | `USER` | [RFC 2253](https://tools.ietf.org/html/2253) Distinguished Name |
| LDAP | `ldapAuthType` | `GROUP` | [RFC 2253](https://tools.ietf.org/html/2253) Distinguished Name |
| OIDC Workforce | `oidcAuthType` | `IDP_GROUP` | Atlas OIDC IdP ID (found in federation settings), followed by a ''/'', followed by the IdP group name |
| OIDC Workload | `oidcAuthType` | `USER` | Atlas OIDC IdP ID (found in federation settings), followed by a ''/'', followed by the IdP user name |
| SCRAM-SHA | `awsIAMType`, `x509Type`, `ldapAuthType`, `oidcAuthType` | `NONE` | Alphanumeric string |
'
in: path
name: username
required: true
schema:
example: 'SCRAM-SHA: dylan or AWS IAM: arn:aws:iam::123456789012:user/sales/enterprise/DylanBloggs or x.509/LDAP: CN=Dylan Bloggs,OU=Enterprise,OU=Sales,DC=Example,DC=COM or OIDC: IdPIdentifier/IdPGroupName'
type: string
requestBody:
content:
application/vnd.atlas.2023-01-01+json:
schema:
$ref: '#/components/schemas/CloudDatabaseUser'
description: Updates one database user that belongs to the specified project.
required: true
responses:
'200':
content:
application/vnd.atlas.2023-01-01+json:
schema:
$ref: '#/components/schemas/CloudDatabaseUser'
x-xgen-version: '2023-01-01'
description: OK
headers:
RateLimit-Limit:
$ref: '#/components/headers/HeaderRateLimitLimit'
RateLimit-Remaining:
$ref: '#/components/headers/HeaderRateLimitRemaining'
'400':
$ref: '#/components/responses/badRequest'
'401':
$ref: '#/components/responses/unauthorized'
'403':
$ref: '#/components/responses/forbidden'
'404':
$ref: '#/components/responses/notFound'
'409':
$ref: '#/components/responses/conflict'
'429':
$ref: '#/components/responses/tooManyRequests'
'500':
$ref: '#/components/responses/internalServerError'
summary: Update One Database User in One Project
tags:
- Database Users
x-codeSamples:
- lang: cURL
label: Atlas CLI
source: atlas api databaseUsers updateDatabaseUser --help
- lang: go
label: Go
source: "import (\n\t\"os\"\n\t\"context\"\n\t\"log\"\n\tsdk \"go.mongodb.org/atlas-sdk/v20250312001/admin\"\n)\n\nfunc main() {\n\tctx := context.Background()\n\tclientID := os.Getenv(\"MONGODB_ATLAS_CLIENT_ID\")\n\tclientSecret := os.Getenv(\"MONGODB_ATLAS_CLIENT_SECRET\")\n\n\t// See https://dochub.mongodb.org/core/atlas-go-sdk-oauth\n\tclient, err := sdk.NewClient(sdk.UseOAuthAuth(clientID, clientSecret))\n\n\tif err != nil {\n\t\tlog.Fatalf(\"Error: %v\", err)\n\t}\n\n\tparams = &sdk.UpdateGroupDatabaseUserApiParams{}\n\tsdkResp, httpResp, err := client.DatabaseUsersApi.\n\t\tUpdateGroupDatabaseUserWithParams(ctx, params).\n\t\tExecute()\n}\n"
- lang: cURL
label: curl (Service Accounts)
source: "curl --include --header \"Authorization: Bearer ${ACCESS_TOKEN}\" \\\n --header \"Accept: application/vnd.atlas.2025-03-12+json\" \\\n --header \"Content-Type: application/json\" \\\n -X PATCH \"https://cloud.mongodb.com/api/atlas/v2/groups/{groupId}/databaseUsers/{databaseName}/{username}\" \\\n -d '{ <Payload> }'"
- lang: cURL
label: curl (Digest)
source: "curl --user \"${PUBLIC_KEY}:${PRIVATE_KEY}\" \\\n --digest --include \\\n --header \"Accept: application/vnd.atlas.2025-03-12+json\" \\\n --header \"Content-Type: application/json\" \\\n -X PATCH \"https://cloud.mongodb.com/api/atlas/v2/groups/{groupId}/databaseUsers/{databaseName}/{username}\" \\\n -d '{ <Payload> }'"
x-rolesRequirements:
- Project Database Access Admin
- Project Stream Processing Owner
x-xgen-docs-url: https://mongodb.com/docs/atlas/reference/api-resources-spec/v2/#tag/Database-Users/operation/updateGroupDatabaseUser
x-xgen-operation-id-override: updateDatabaseUser
components:
parameters:
envelope:
description: Flag that indicates whether Application wraps the response in an `envelope` JSON object. Some API clients cannot access the HTTP response headers or status code. To remediate this, set envelope=true in the query. Endpoints that return a list of results use the results object as an envelope. Application adds the status parameter to the response body.
in: query
name: envelope
schema:
default: false
type: boolean
groupId:
description: 'Unique 24-hexadecimal digit string that identifies your project. Use the [/groups](#tag/Projects/operation/listProjects) endpoint to retrieve all projects to which the authenticated user has access.
**NOTE**: Groups and projects are synonymous terms. Your group id is the same as your project id. For existing groups, your group/project id remains the same. The resource and corresponding endpoints use the term groups.'
in: path
name: groupId
required: true
schema:
example: 32b6e34b3d91647abb20e7b8
pattern: ^([a-f0-9]{24})$
type: string
pretty:
description: Flag that indicates whether the response body should be in the prettyprint format.
in: query
name: pretty
schema:
default: false
externalDocs:
description: Prettyprint
url: https://en.wikipedia.org/wiki/Prettyprint
type: boolean
includeCount:
description: Flag that indicates whether the response returns the total number of items (`totalCount`) in the response.
in: query
name: includeCount
schema:
default: true
type: boolean
pageNum:
description: Number of the page that displays the current set of the total objects that the response returns.
in: query
name: pageNum
schema:
default: 1
minimum: 1
type: integer
itemsPerPage:
description: Number of items that the response returns per page.
in: query
name: itemsPerPage
schema:
default: 100
maximum: 500
minimum: 1
type: integer
schemas:
PaginatedApiAtlasDatabaseUserView:
description: List of MongoDB Database users granted access to databases in the specified project.
properties:
links:
description: List of one or more Uniform Resource Locators (URLs) that point to API sub-resources, related API resources, or both. RFC 5988 outlines these relationships.
externalDocs:
description: Web Linking Specification (RFC 5988)
url: https://datatracker.ietf.org/doc/html/rfc5988
items:
$ref: '#/components/schemas/Link'
readOnly: true
type: array
results:
de
# --- truncated at 32 KB (47 KB total) ---
# Full source: https://raw.githubusercontent.com/api-evangelist/mongodb/refs/heads/main/openapi/mongodb-database-users-api-openapi.yml