MongoDB Database Users API
Returns, adds, edits, and removes database users.
OpenAPI Specification
openapi: 3.0.1
info:
description: "The MongoDB Atlas Administration API allows developers to manage all components in MongoDB Atlas.\n\nThe Atlas Administration API supports OAuth2 Service Accounts and HTTP Digest-based API keys. Service accounts are the recommended authentication method and API keys are considered a legacy option.\n\nTo authenticate with a Service Account, first exchange its client ID and secret for an access token using the OAuth 2.0 Client Credentials flow. Atlas provides a token endpoint at `POST https://cloud.mongodb.com/api/oauth/token`, which returns a Bearer token that is reusable and valid for 1 hour (3600 seconds).\n\nFor example, to [return a list of your organizations](https://www.mongodb.com/docs/api/doc/atlas-admin-api-v2/operation/operation-listorgs) with [cURL](https://en.wikipedia.org/wiki/CURL), first generate an access token and then use that token to call the same Atlas Administration API endpoint shown in the current example:\n\n```\nACCESS_TOKEN=$(curl -fsS --request POST https://cloud.mongodb.com/api/oauth/token \\\n --header \"Authorization: Basic $(printf '%s' \"${CLIENT_ID}:${CLIENT_SECRET}\" | base64 | tr -d '\\n')\" \\\n --header \"Content-Type: application/x-www-form-urlencoded\" \\\n --header \"Accept: application/json\" \\\n --data \"grant_type=client_credentials\" | jq -r '.access_token')\n\ncurl --header \"Authorization: Bearer ${ACCESS_TOKEN}\" \\\n --header \"Accept: application/vnd.atlas.2025-03-12+json\" \\\n -X GET \"https://cloud.mongodb.com/api/atlas/v2/orgs?pretty=true\"\n```\n\nIf your organization requires an IP access list for the Atlas Administration API, the token can be created from any IP address, but the API call that uses the token must originate from an allowed IP.\n\nTo learn more, see [Get Started with the Atlas Administration API](https://www.mongodb.com/docs/atlas/configure-api-access/). For support, see [MongoDB Support](https://www.mongodb.com/support/get-started).\n\nYou can also explore the various endpoints available through the Atlas Administration API in MongoDB's [Postman workspace](https://www.postman.com/mongodb-devrel/workspace/mongodb-atlas-administration-apis/) (requires a Postman account)."
license:
name: CC BY-NC-SA 3.0 US
url: https://creativecommons.org/licenses/by-nc-sa/3.0/us/
termsOfService: https://www.mongodb.com/mongodb-management-service-terms-and-conditions
title: MongoDB Atlas Administration Access Tracking Database Users API
version: '2.0'
x-xgen-sha: 3d70e065843c008b9871ea7836c98c9de6f202f9
servers:
- url: https://cloud.mongodb.com
security:
- ServiceAccounts: []
- DigestAuth: []
tags:
- description: Returns, adds, edits, and removes database users.
name: Database Users
paths:
/api/atlas/v2/groups/{groupId}/databaseUsers:
get:
description: Returns all database users that belong to the specified project. To use this resource, the requesting Service Account or API Key must have the Project Read Only role.
operationId: listGroupDatabaseUsers
parameters:
- $ref: '#/components/parameters/envelope'
- $ref: '#/components/parameters/groupId'
- $ref: '#/components/parameters/includeCount'
- $ref: '#/components/parameters/itemsPerPage'
- $ref: '#/components/parameters/pageNum'
- $ref: '#/components/parameters/pretty'
responses:
'200':
content:
application/vnd.atlas.2023-01-01+json:
schema:
$ref: '#/components/schemas/PaginatedApiAtlasDatabaseUserView'
x-xgen-version: '2023-01-01'
description: OK
headers:
RateLimit-Limit:
$ref: '#/components/headers/HeaderRateLimitLimit'
RateLimit-Remaining:
$ref: '#/components/headers/HeaderRateLimitRemaining'
'401':
$ref: '#/components/responses/unauthorized'
'403':
$ref: '#/components/responses/forbidden'
'404':
$ref: '#/components/responses/notFound'
'429':
$ref: '#/components/responses/tooManyRequests'
'500':
$ref: '#/components/responses/internalServerError'
summary: Return All Database Users in One Project
tags:
- Database Users
x-codeSamples:
- lang: cURL
label: Atlas CLI
source: atlas api databaseUsers listDatabaseUsers --help
- lang: go
label: Go
source: "import (\n\t\"os\"\n\t\"context\"\n\t\"log\"\n\tsdk \"go.mongodb.org/atlas-sdk/v20250312001/admin\"\n)\n\nfunc main() {\n\tctx := context.Background()\n\tclientID := os.Getenv(\"MONGODB_ATLAS_CLIENT_ID\")\n\tclientSecret := os.Getenv(\"MONGODB_ATLAS_CLIENT_SECRET\")\n\n\t// See https://dochub.mongodb.org/core/atlas-go-sdk-oauth\n\tclient, err := sdk.NewClient(sdk.UseOAuthAuth(clientID, clientSecret))\n\n\tif err != nil {\n\t\tlog.Fatalf(\"Error: %v\", err)\n\t}\n\n\tparams = &sdk.ListGroupDatabaseUsersApiParams{}\n\tsdkResp, httpResp, err := client.DatabaseUsersApi.\n\t\tListGroupDatabaseUsersWithParams(ctx, params).\n\t\tExecute()\n}\n"
- lang: cURL
label: curl (Service Accounts)
source: "curl --include --header \"Authorization: Bearer ${ACCESS_TOKEN}\" \\\n --header \"Accept: application/vnd.atlas.2025-03-12+json\" \\\n -X GET \"https://cloud.mongodb.com/api/atlas/v2/groups/{groupId}/databaseUsers?pretty=true\""
- lang: cURL
label: curl (Digest)
source: "curl --user \"${PUBLIC_KEY}:${PRIVATE_KEY}\" \\\n --digest --include \\\n --header \"Accept: application/vnd.atlas.2025-03-12+json\" \\\n -X GET \"https://cloud.mongodb.com/api/atlas/v2/groups/{groupId}/databaseUsers?pretty=true\""
x-rolesRequirements:
- Project Read Only
x-xgen-docs-url: https://mongodb.com/docs/atlas/reference/api-resources-spec/v2/#tag/Database-Users/operation/listGroupDatabaseUsers
x-xgen-operation-id-override: listDatabaseUsers
post:
description: Creates one database user in the specified project. This MongoDB Cloud supports a maximum of 100 database users per project. If you require more than 100 database users on a project, contact Support. To use this resource, the requesting Service Account or API Key must have the Project Owner role, the Project Charts Admin role, Project Stream Processing Owner role, or the Project Database Access Admin role.
externalDocs:
description: Contact MongoDB Support
url: https://cloud.mongodb.com/support
operationId: createGroupDatabaseUser
parameters:
- $ref: '#/components/parameters/envelope'
- $ref: '#/components/parameters/groupId'
- $ref: '#/components/parameters/pretty'
requestBody:
content:
application/vnd.atlas.2023-01-01+json:
examples:
AWS IAM Authentication:
description: AWS IAM Authentication
value:
awsIAMType: USER
databaseName: $external
groupId: 32b6e34b3d91647abb20e7b8
roles:
- databaseName: sales
roleName: readWrite
- databaseName: marketing
roleName: read
scopes:
- name: myCluster
type: CLUSTER
username: arn:aws:iam::358363220050:user/mongodb-aws-iam-auth-test-user
LDAP Authentication:
description: LDAP Authentication
value:
databaseName: admin
groupId: 32b6e34b3d91647abb20e7b8
ldapAuthType: GROUP
roles:
- databaseName: sales
roleName: readWrite
- databaseName: marketing
roleName: read
scopes:
- name: myCluster
type: CLUSTER
username: CN=marketing,OU=groups,DC=example,DC=com
OIDC Workforce Federated Authentication:
description: OIDC Workforce Federated Authentication
value:
databaseName: admin
groupId: 32b6e34b3d91647abb20e7b8
oidcAuthType: IDP_GROUP
roles:
- databaseName: sales
roleName: readWrite
- databaseName: marketing
roleName: read
scopes:
- name: myCluster
type: CLUSTER
username: 5dd7496c7a3e5a648454341c/sales
OIDC Workload Federated Authentication:
description: OIDC Workload Federated Authentication
value:
databaseName: $external
groupId: 32b6e34b3d91647abb20e7b8
oidcAuthType: USER
roles:
- databaseName: sales
roleName: readWrite
- databaseName: marketing
roleName: read
scopes:
- name: myCluster
type: CLUSTER
username: 5dd7496c7a3e5a648454341c/sales
SCRAM-SHA Authentication:
description: SCRAM-SHA Authentication
value:
databaseName: admin
groupId: 32b6e34b3d91647abb20e7b8
password: changeme123
roles:
- databaseName: sales
roleName: readWrite
- databaseName: marketing
roleName: read
scopes:
- name: myCluster
type: CLUSTER
username: david
X509 Authentication:
description: X509 Authentication
value:
databaseName: $external
groupId: 32b6e34b3d91647abb20e7b8
roles:
- databaseName: sales
roleName: readWrite
- databaseName: marketing
roleName: read
scopes:
- name: myCluster
type: CLUSTER
username: CN=david@example.com,OU=users,DC=example,DC=com
x509Type: CUSTOMER
schema:
$ref: '#/components/schemas/CloudDatabaseUser'
description: Creates one database user in the specified project.
required: true
responses:
'201':
content:
application/vnd.atlas.2023-01-01+json:
schema:
$ref: '#/components/schemas/CloudDatabaseUser'
x-xgen-version: '2023-01-01'
description: OK
headers:
RateLimit-Limit:
$ref: '#/components/headers/HeaderRateLimitLimit'
RateLimit-Remaining:
$ref: '#/components/headers/HeaderRateLimitRemaining'
'400':
$ref: '#/components/responses/badRequest'
'401':
$ref: '#/components/responses/unauthorized'
'403':
$ref: '#/components/responses/forbidden'
'404':
$ref: '#/components/responses/notFound'
'409':
$ref: '#/components/responses/conflict'
'429':
$ref: '#/components/responses/tooManyRequests'
'500':
$ref: '#/components/responses/internalServerError'
summary: Create One Database User in One Project
tags:
- Database Users
x-codeSamples:
- lang: cURL
label: Atlas CLI
source: atlas api databaseUsers createDatabaseUser --help
- lang: go
label: Go
source: "import (\n\t\"os\"\n\t\"context\"\n\t\"log\"\n\tsdk \"go.mongodb.org/atlas-sdk/v20250312001/admin\"\n)\n\nfunc main() {\n\tctx := context.Background()\n\tclientID := os.Getenv(\"MONGODB_ATLAS_CLIENT_ID\")\n\tclientSecret := os.Getenv(\"MONGODB_ATLAS_CLIENT_SECRET\")\n\n\t// See https://dochub.mongodb.org/core/atlas-go-sdk-oauth\n\tclient, err := sdk.NewClient(sdk.UseOAuthAuth(clientID, clientSecret))\n\n\tif err != nil {\n\t\tlog.Fatalf(\"Error: %v\", err)\n\t}\n\n\tparams = &sdk.CreateGroupDatabaseUserApiParams{}\n\tsdkResp, httpResp, err := client.DatabaseUsersApi.\n\t\tCreateGroupDatabaseUserWithParams(ctx, params).\n\t\tExecute()\n}\n"
- lang: cURL
label: curl (Service Accounts)
source: "curl --include --header \"Authorization: Bearer ${ACCESS_TOKEN}\" \\\n --header \"Accept: application/vnd.atlas.2025-03-12+json\" \\\n --header \"Content-Type: application/json\" \\\n -X POST \"https://cloud.mongodb.com/api/atlas/v2/groups/{groupId}/databaseUsers\" \\\n -d '{ <Payload> }'"
- lang: cURL
label: curl (Digest)
source: "curl --user \"${PUBLIC_KEY}:${PRIVATE_KEY}\" \\\n --digest --include \\\n --header \"Accept: application/vnd.atlas.2025-03-12+json\" \\\n --header \"Content-Type: application/json\" \\\n -X POST \"https://cloud.mongodb.com/api/atlas/v2/groups/{groupId}/databaseUsers\" \\\n -d '{ <Payload> }'"
x-rolesRequirements:
- Project Database Access Admin
- Project Stream Processing Owner
x-xgen-docs-url: https://mongodb.com/docs/atlas/reference/api-resources-spec/v2/#tag/Database-Users/operation/createGroupDatabaseUser
x-xgen-operation-id-override: createDatabaseUser
/api/atlas/v2/groups/{groupId}/databaseUsers/{databaseName}/{username}:
delete:
description: Removes one database user from the specified project. To use this resource, the requesting Service Account or API Key must have the Project Owner role, the Project Stream Processing Owner role, or the Project Database Access Admin role.
operationId: deleteGroupDatabaseUser
parameters:
- $ref: '#/components/parameters/envelope'
- $ref: '#/components/parameters/groupId'
- $ref: '#/components/parameters/pretty'
- description: The database against which the database user authenticates. Database users must provide both a username and authentication database to log into MongoDB. If the user authenticates with AWS IAM, x.509, LDAP, or OIDC Workload this value should be `$external`. If the user authenticates with SCRAM-SHA or OIDC Workforce, this value should be `admin`.
in: path
name: databaseName
required: true
schema:
type: string
- description: 'Human-readable label that represents the user that authenticates to MongoDB. The format of this label depends on the method of authentication:
| Authentication Method | Parameter Needed | Parameter Value | username Format |
|---|---|---|---|
| AWS IAM | `awsIAMType` | `ROLE` | <abbr title="Amazon Resource Name">ARN</abbr> |
| AWS IAM | `awsIAMType` | `USER` | <abbr title="Amazon Resource Name">ARN</abbr> |
| x.509 | `x509Type` | `CUSTOMER` | [RFC 2253](https://tools.ietf.org/html/2253) Distinguished Name |
| x.509 | `x509Type` | `MANAGED` | [RFC 2253](https://tools.ietf.org/html/2253) Distinguished Name |
| LDAP | `ldapAuthType` | `USER` | [RFC 2253](https://tools.ietf.org/html/2253) Distinguished Name |
| LDAP | `ldapAuthType` | `GROUP` | [RFC 2253](https://tools.ietf.org/html/2253) Distinguished Name |
| OIDC Workforce | `oidcAuthType` | `IDP_GROUP` | Atlas OIDC IdP ID (found in federation settings), followed by a ''/'', followed by the IdP group name |
| OIDC Workload | `oidcAuthType` | `USER` | Atlas OIDC IdP ID (found in federation settings), followed by a ''/'', followed by the IdP user name |
| SCRAM-SHA | `awsIAMType`, `x509Type`, `ldapAuthType`, `oidcAuthType` | `NONE` | Alphanumeric string |
'
in: path
name: username
required: true
schema:
example: 'SCRAM-SHA: dylan or AWS IAM: arn:aws:iam::123456789012:user/sales/enterprise/DylanBloggs or x.509/LDAP: CN=Dylan Bloggs,OU=Enterprise,OU=Sales,DC=Example,DC=COM or OIDC: IdPIdentifier/IdPGroupName'
type: string
responses:
'204':
content:
application/vnd.atlas.2023-01-01+json:
x-xgen-version: '2023-01-01'
description: This endpoint does not return a response body.
headers:
RateLimit-Limit:
$ref: '#/components/headers/HeaderRateLimitLimit'
RateLimit-Remaining:
$ref: '#/components/headers/HeaderRateLimitRemaining'
'401':
$ref: '#/components/responses/unauthorized'
'403':
$ref: '#/components/responses/forbidden'
'404':
$ref: '#/components/responses/notFound'
'429':
$ref: '#/components/responses/tooManyRequests'
'500':
$ref: '#/components/responses/internalServerError'
summary: Remove One Database User from One Project
tags:
- Database Users
x-codeSamples:
- lang: cURL
label: Atlas CLI
source: atlas api databaseUsers deleteDatabaseUser --help
- lang: go
label: Go
source: "import (\n\t\"os\"\n\t\"context\"\n\t\"log\"\n\tsdk \"go.mongodb.org/atlas-sdk/v20250312001/admin\"\n)\n\nfunc main() {\n\tctx := context.Background()\n\tclientID := os.Getenv(\"MONGODB_ATLAS_CLIENT_ID\")\n\tclientSecret := os.Getenv(\"MONGODB_ATLAS_CLIENT_SECRET\")\n\n\t// See https://dochub.mongodb.org/core/atlas-go-sdk-oauth\n\tclient, err := sdk.NewClient(sdk.UseOAuthAuth(clientID, clientSecret))\n\n\tif err != nil {\n\t\tlog.Fatalf(\"Error: %v\", err)\n\t}\n\n\tparams = &sdk.DeleteGroupDatabaseUserApiParams{}\n\thttpResp, err := client.DatabaseUsersApi.\n\t\tDeleteGroupDatabaseUserWithParams(ctx, params).\n\t\tExecute()\n}\n"
- lang: cURL
label: curl (Service Accounts)
source: "curl --include --header \"Authorization: Bearer ${ACCESS_TOKEN}\" \\\n --header \"Accept: application/vnd.atlas.2025-03-12+json\" \\\n -X DELETE \"https://cloud.mongodb.com/api/atlas/v2/groups/{groupId}/databaseUsers/{databaseName}/{username}\""
- lang: cURL
label: curl (Digest)
source: "curl --user \"${PUBLIC_KEY}:${PRIVATE_KEY}\" \\\n --digest --include \\\n --header \"Accept: application/vnd.atlas.2025-03-12+json\" \\\n -X DELETE \"https://cloud.mongodb.com/api/atlas/v2/groups/{groupId}/databaseUsers/{databaseName}/{username}\""
x-rolesRequirements:
- Project Database Access Admin
- Project Stream Processing Owner
x-xgen-docs-url: https://mongodb.com/docs/atlas/reference/api-resources-spec/v2/#tag/Database-Users/operation/deleteGroupDatabaseUser
x-xgen-operation-id-override: deleteDatabaseUser
get:
description: Returns one database user that belong to the specified project. To use this resource, the requesting Service Account or API Key must have the Project Read Only role.
operationId: getGroupDatabaseUser
parameters:
- $ref: '#/components/parameters/envelope'
- $ref: '#/components/parameters/groupId'
- $ref: '#/components/parameters/pretty'
- description: The database against which the database user authenticates. Database users must provide both a username and authentication database to log into MongoDB. If the user authenticates with AWS IAM, x.509, LDAP, or OIDC Workload this value should be `$external`. If the user authenticates with SCRAM-SHA or OIDC Workforce, this value should be `admin`.
in: path
name: databaseName
required: true
schema:
type: string
- description: 'Human-readable label that represents the user that authenticates to MongoDB. The format of this label depends on the method of authentication:
| Authentication Method | Parameter Needed | Parameter Value | username Format |
|---|---|---|---|
| AWS IAM | `awsIAMType` | `ROLE` | <abbr title="Amazon Resource Name">ARN</abbr> |
| AWS IAM | `awsIAMType` | `USER` | <abbr title="Amazon Resource Name">ARN</abbr> |
| x.509 | `x509Type` | `CUSTOMER` | [RFC 2253](https://tools.ietf.org/html/2253) Distinguished Name |
| x.509 | `x509Type` | `MANAGED` | [RFC 2253](https://tools.ietf.org/html/2253) Distinguished Name |
| LDAP | `ldapAuthType` | `USER` | [RFC 2253](https://tools.ietf.org/html/2253) Distinguished Name |
| LDAP | `ldapAuthType` | `GROUP` | [RFC 2253](https://tools.ietf.org/html/2253) Distinguished Name |
| OIDC Workforce | `oidcAuthType` | `IDP_GROUP` | Atlas OIDC IdP ID (found in federation settings), followed by a ''/'', followed by the IdP group name |
| OIDC Workload | `oidcAuthType` | `USER` | Atlas OIDC IdP ID (found in federation settings), followed by a ''/'', followed by the IdP user name |
| SCRAM-SHA | `awsIAMType`, `x509Type`, `ldapAuthType`, `oidcAuthType` | `NONE` | Alphanumeric string |
'
in: path
name: username
required: true
schema:
example: 'SCRAM-SHA: dylan or AWS IAM: arn:aws:iam::123456789012:user/sales/enterprise/DylanBloggs or x.509/LDAP: CN=Dylan Bloggs,OU=Enterprise,OU=Sales,DC=Example,DC=COM or OIDC: IdPIdentifier/IdPGroupName'
type: string
responses:
'200':
content:
application/vnd.atlas.2023-01-01+json:
schema:
$ref: '#/components/schemas/CloudDatabaseUser'
x-xgen-version: '2023-01-01'
description: OK
headers:
RateLimit-Limit:
$ref: '#/components/headers/HeaderRateLimitLimit'
RateLimit-Remaining:
$ref: '#/components/headers/HeaderRateLimitRemaining'
'401':
$ref: '#/components/responses/unauthorized'
'403':
$ref: '#/components/responses/forbidden'
'404':
$ref: '#/components/responses/notFound'
'429':
$ref: '#/components/responses/tooManyRequests'
'500':
$ref: '#/components/responses/internalServerError'
summary: Return One Database User from One Project
tags:
- Database Users
x-codeSamples:
- lang: cURL
label: Atlas CLI
source: atlas api databaseUsers getDatabaseUser --help
- lang: go
label: Go
source: "import (\n\t\"os\"\n\t\"context\"\n\t\"log\"\n\tsdk \"go.mongodb.org/atlas-sdk/v20250312001/admin\"\n)\n\nfunc main() {\n\tctx := context.Background()\n\tclientID := os.Getenv(\"MONGODB_ATLAS_CLIENT_ID\")\n\tclientSecret := os.Getenv(\"MONGODB_ATLAS_CLIENT_SECRET\")\n\n\t// See https://dochub.mongodb.org/core/atlas-go-sdk-oauth\n\tclient, err := sdk.NewClient(sdk.UseOAuthAuth(clientID, clientSecret))\n\n\tif err != nil {\n\t\tlog.Fatalf(\"Error: %v\", err)\n\t}\n\n\tparams = &sdk.GetGroupDatabaseUserApiParams{}\n\tsdkResp, httpResp, err := client.DatabaseUsersApi.\n\t\tGetGroupDatabaseUserWithParams(ctx, params).\n\t\tExecute()\n}\n"
- lang: cURL
label: curl (Service Accounts)
source: "curl --include --header \"Authorization: Bearer ${ACCESS_TOKEN}\" \\\n --header \"Accept: application/vnd.atlas.2025-03-12+json\" \\\n -X GET \"https://cloud.mongodb.com/api/atlas/v2/groups/{groupId}/databaseUsers/{databaseName}/{username}?pretty=true\""
- lang: cURL
label: curl (Digest)
source: "curl --user \"${PUBLIC_KEY}:${PRIVATE_KEY}\" \\\n --digest --include \\\n --header \"Accept: application/vnd.atlas.2025-03-12+json\" \\\n -X GET \"https://cloud.mongodb.com/api/atlas/v2/groups/{groupId}/databaseUsers/{databaseName}/{username}?pretty=true\""
x-rolesRequirements:
- Project Read Only
x-xgen-docs-url: https://mongodb.com/docs/atlas/reference/api-resources-spec/v2/#tag/Database-Users/operation/getGroupDatabaseUser
x-xgen-operation-id-override: getDatabaseUser
patch:
description: Updates one database user that belongs to the specified project. To use this resource, the requesting Service Account or API Key must have the Project Owner role, Project Charts Admin role, Project Stream Processing Owner role, or the Project Database Access Admin role.
operationId: updateGroupDatabaseUser
parameters:
- $ref: '#/components/parameters/envelope'
- $ref: '#/components/parameters/groupId'
- $ref: '#/components/parameters/pretty'
- description: The database against which the database user authenticates. Database users must provide both a username and authentication database to log into MongoDB. If the user authenticates with AWS IAM, x.509, LDAP, or OIDC Workload this value should be `$external`. If the user authenticates with SCRAM-SHA or OIDC Workforce, this value should be `admin`.
in: path
name: databaseName
required: true
schema:
type: string
- description: 'Human-readable label that represents the user that authenticates to MongoDB. The format of this label depends on the method of authentication:
| Authentication Method | Parameter Needed | Parameter Value | username Format |
|---|---|---|---|
| AWS IAM | `awsIAMType` | `ROLE` | <abbr title="Amazon Resource Name">ARN</abbr> |
| AWS IAM | `awsIAMType` | `USER` | <abbr title="Amazon Resource Name">ARN</abbr> |
| x.509 | `x509Type` | `CUSTOMER` | [RFC 2253](https://tools.ietf.org/html/2253) Distinguished Name |
| x.509 | `x509Type` | `MANAGED` | [RFC 2253](https://tools.ietf.org/html/2253) Distinguished Name |
| LDAP | `ldapAuthType` | `USER` | [RFC 2253](https://tools.ietf.org/html/2253) Distinguished Name |
| LDAP | `ldapAuthType` | `GROUP` | [RFC 2253](https://tools.ietf.org/html/2253) Distinguished Name |
| OIDC Workforce | `oidcAuthType` | `IDP_GROUP` | Atlas OIDC IdP ID (found in federation settings), followed by a ''/'', followed by the IdP group name |
| OIDC Workload | `oidcAuthType` | `USER` | Atlas OIDC IdP ID (found in federation settings), followed by a ''/'', followed by the IdP user name |
| SCRAM-SHA | `awsIAMType`, `x509Type`, `ldapAuthType`, `oidcAuthType` | `NONE` | Alphanumeric string |
'
in: path
name: username
required: true
schema:
example: 'SCRAM-SHA: dylan or AWS IAM: arn:aws:iam::123456789012:user/sales/enterprise/DylanBloggs or x.509/LDAP: CN=Dylan Bloggs,OU=Enterprise,OU=Sales,DC=Example,DC=COM or OIDC: IdPIdentifier/IdPGroupName'
type: string
requestBody:
content:
application/vnd.atlas.2023-01-01+json:
schema:
$ref: '#/components/schemas/CloudDatabaseUser'
description: Updates one database user that belongs to the specified project.
required: true
responses:
'200':
content:
application/vnd.atlas.2023-01-01+json:
schema:
$ref: '#/components/schemas/CloudDatabaseUser'
x-xgen-version: '2023-01-01'
description: OK
headers:
RateLimit-Limit:
$ref: '#/components/headers/HeaderRateLimitLimit'
RateLimit-Remaining:
$ref: '#/components/headers/HeaderRateLimitRemaining'
'400':
$ref: '#/components/responses/badRequest'
'401':
$ref: '#/components/responses/unauthorized'
'403':
$ref: '#/components/responses/forbidden'
'404':
$ref: '#/components/responses/notFound'
'409':
$ref: '#/components/responses/conflict'
'429':
$ref: '#/components/responses/tooManyRequests'
'500':
$ref: '#/components/responses/internalServerError'
summary: Update One Database User in One Project
tags:
- Database Users
x-codeSamples:
- lang: cURL
label: Atlas CLI
source: atlas api databaseUsers updateDatabaseUser --help
- lang: go
label: Go
source: "import (\n\t\"os\"\n\t\"context\"\n\t\"log\"\n\tsdk \"go.mongodb.org/atlas-sdk/v20250312001/admin\"\n)\n\nfunc main() {\n\tctx := context.Background()\n\tclientID := os.Getenv(\"MONGODB_ATLAS_CLIENT_ID\")\n\tclientSecret := os.Getenv(\"MONGODB_ATLAS_CLIENT_SECRET\")\n\n\t// See https://dochub.mongodb.org/core/atlas-go-sdk-oauth\n\tclient, err := sdk.NewClient(sdk.UseOAuthAuth(clientID, clientSecret))\n\n\tif err != nil {\n\t\tlog.Fatalf(\"Error: %v\", err)\n\t}\n\n\tparams = &sdk.UpdateGroupDatabaseUserApiParams{}\n\tsdkResp, httpResp, err := client.DatabaseUsersApi.\n\t\tUpdateGroupDatabaseUserWithParams(ctx, params).\n\t\tExecute()\n}\n"
- lang: cURL
label: curl (Service Accounts)
source: "curl --include --header \"Authorization: Bearer ${ACCESS_TOKEN}\" \\\n --header \"Accept: application/vnd.atlas.2025-03-12+json\" \\\n --header \"Content-Type: application/json\" \\\n -X PATCH \"https://cloud.mongodb.com/api/atlas/v2/groups/{groupId}/databaseUsers/{databaseName}/{username}\" \\\n -d '{ <Payload> }'"
- lang: cURL
label: curl (Digest)
source: "curl --user \"${PUBLIC_KEY}:${PRIVATE_KEY}\" \\\n --digest --include \\\n --header \"Accept: application/vnd.atlas.2025-03-12+json\" \\\n --header \"Content-Type: application/json\" \\\n -X PATCH \"https://cloud.mongodb.com/api/atlas/v2/groups/{groupId}/databaseUsers/{databaseName}/{username}\" \\\n -d '{ <Payload> }'"
x-rolesRequirements:
- Project Database Access Admin
- Project Stream Processing Owner
x-xgen-docs-url: https://mongodb.com/docs/atlas/reference/api-resources-spec/v2/#tag/Database-Users/operation/updateGroupDatabaseUser
x-xgen-operation-id-override: updateDatabaseUser
components:
responses:
internalServerError:
content:
application/json:
example:
detail: (This is just an example, the exception may not be related to this endpoint)
error: 500
errorCode: UNEXPECTED_ERROR
reason: Internal Server Error
schema:
$ref: '#/components/schemas/ApiError'
description: Internal Server Error.
forbidden:
content:
application/json:
example:
detail: (This is just an example, the exception may not be related to this endpoint)
error: 403
errorCode: CANNOT_CHANGE_GROUP_NAME
reason: Forbidden
schema:
$ref: '#/components/schemas/ApiError'
description: Forbidden.
tooManyRequests:
content:
application/json:
example:
detail: (This is just an example, the exception may not be related to this endpoint)
error: 429
errorCode: RATE_LIMITED
reason: Too Many Requests
schema:
$ref: '#/components/schemas/ApiError'
description: Too Many Requests.
headers:
RateLimit-Limit:
$ref: '#/components/headers/HeaderRateLimitLimit'
RateLimit-Remaining:
$ref: '#/components/headers/HeaderRateLimitRemaining'
Retry-After:
$ref: '#/components/headers/HeaderRetryAfter'
unauthorized:
content:
application/json:
example:
detail: (This is just an example, the exception may not be related to this endpoint)
error: 401
errorCode: NOT_ORG_GROUP_CREATOR
reason: Unauthorized
schema:
$ref: '#/components/schemas/ApiError'
description: Unauthorized.
conflict:
content:
application/json:
example:
detail: '(This is just an example, the exception may not be related to this endpoint) Cannot delete organization link while there is active migration in following project ids: 60c4fd418ebe251047c50554'
error: 409
errorCode: CANNOT_DELETE_ORG_ACTIVE_LIVE_MIGRATION_ATLAS_ORG_LINK
reason: Conflict
schema:
$ref: '#/components/schemas/ApiError'
description: Conflict.
badRequest:
content:
application/json:
example:
detail: (This is just an example, the exception may not be related to this endpoint) No provider AWS exists.
error: 400
errorCode: VALIDATION_ERROR
reason: Bad Request
schema:
$ref: '#/components/schemas/ApiError'
description: Bad Request.
notFound:
content:
application/json:
example:
detail: (T
# --- truncated at 32 KB (47 KB total) ---
# Full source: https://raw.githubusercontent.com/api-evangelist/mongodb/refs/heads/main/openapi/mongodb-database-users-api-openapi.yml