*REST API › Endpoint reference › Operations › Staff*

# Update a staff member

> Updates the ORGANIZATIONAL record of a staff member (send only the fields to change): collection, tags, driving license, visibility in the planner and the external reference used to match them with the record in your system.

Identity, contact details and employment terms cannot be written here. Returns the updated member.

`PATCH /api/v1/staff/{staffId}` — scope `staff:write`

Scope: `staff:write` · 120/min · Strict tenancy · Idempotency-Key · If-Match · MCP: `filmo_staff_update`

## Authorizations

Bearer API key with the scope below. `staff:write`

## Headers

| Name | Type | Required | Description |
| --- | --- | --- | --- |
| `Idempotency-Key` | string | No | Unique identifier of the request, chosen by the client (a UUID works). Between 1 and 255 characters: an empty header is rejected with 400 `validation_error`, because the client would believe itself protected. Repeating the same key with the SAME body within 24 h returns the stored response without executing again, with the `Idempotent-Replay: true` header. With a DIFFERENT body it returns 422. It is the safe way to retry after a network timeout. |
| `If-Match` | string | No | Optimistic locking: the `ETag` you read from the resource (or `*`). If the resource changed since, the write is rejected with `412 precondition_failed` before doing anything; read it again and retry. Without the header the write always proceeds. |

## Path parameters

| Name | Type | Required | Description |
| --- | --- | --- | --- |
| `staffId` | string | Yes | Staff member identifier. |

## Body

Body schema: `StaffUpdateBody`

| Name | Type | Required | Description |
| --- | --- | --- | --- |
| `fullName` | string | No | Full name. |
| `staffType` | string | No | Engagement type with the company. `employee`, `freelancer`, `contractor` |
| `collectionId` | string | No | Collection it belongs to; null removes them from any collection. |
| `tags` | string[] | No | Tags by identifier or name. Replaces the whole list. |
| `hasDrivingLicense` | boolean | No | Whether they hold a driving licence. |
| `showInPlanner` | boolean | No | Whether they appear as an assignable resource in the planner. |
| `externalRef` | string | No | Reference in the integrator system. It is the field used to match the two records; null clears it. |

## Request examples

*Update a staff member*

**cURL**

```bash
curl https://app.filmo.io/api/v1/staff/staf_8f2a1c \
  --request PATCH \
  --header "Authorization: Bearer $FILMO_API_KEY" \
  --header "Idempotency-Key: $(uuidgen 2>/dev/null || cat /proc/sys/kernel/random/uuid)" \
  --header 'Content-Type: application/json' \
  --data '{
  "externalRef": "HR-00412",
  "showInPlanner": true,
  "hasDrivingLicense": true
}'
```

**Node.js**

```javascript
fetch('https://app.filmo.io/api/v1/staff/staf_8f2a1c', {
  method: 'PATCH',
  headers: {
    Authorization: 'Bearer YOUR_FILMO_API_KEY',
    'Idempotency-Key': crypto.randomUUID(),
    'Content-Type': 'application/json'
  },
  body: JSON.stringify({
    externalRef: 'HR-00412',
    showInPlanner: true,
    hasDrivingLicense: true
  })
})
```

**Python**

```python
import uuid
import requests

requests.patch(
    "https://app.filmo.io/api/v1/staff/staf_8f2a1c",
    headers={
      "Authorization": "Bearer YOUR_FILMO_API_KEY",
      "Idempotency-Key": str(uuid.uuid4()),
      "Content-Type": "application/json"
    },
    json={
      "externalRef": "HR-00412",
      "showInPlanner": True,
      "hasDrivingLicense": True
    }
)
```

## Response

Response schema: `StaffMemberDto`

| Status | Description |
| --- | --- |
| 200 | Successful response. |
| 400 | Invalid request (validation_error): malformed query or body. `errors[]` lists every offending field with its stable code. |
| 401 | Authentication failed (unauthorized, api_key_invalid, api_key_revoked, api_key_expired, api_key_owner_inactive, api_key_owner_not_admin). |
| 403 | Not allowed (insufficient_scope: the API key does not have the required scope, named in `requiredScope`; forbidden: the owner of the key lacks the permission the operation requires). `insufficient_scope` is answered before the request counts against the rate limit, so it carries no `RateLimit-*` headers; `forbidden` does. |
| 404 | Resource not found (not_found): it does not exist or is outside the scope of the API key. |
| 409 | Conflict (conflict): the current state of the resource prevents the operation, a request with that Idempotency-Key is already in progress, or another conditional write (`If-Match`) held the resource for more than five seconds. `errors[0].code` says which: `in_progress` and `lock_timeout` are solved by retrying; `invalid_state` is not, because the state of the resource forbids the operation. |
| 412 | Precondition failed (precondition_failed): the `If-Match` entity tag does not match the current representation. Read the resource again and retry. |
| 422 | Idempotency-Key reused (idempotency_key_reused): the same key was used before with a different body. Change the key. |
| 429 | Rate limit exceeded (rate_limited): retry after `Retry-After` seconds; `RateLimit-*` says which quota ran out. |
| 500 | Internal error (internal_error). |

**200**

| Name | Type | Description |
| --- | --- | --- |
| `data` | object | Staff member, with the minimum projection needed for planning. Does NOT include contact, identity, employment or platform access data: see the resource documentation. |
| `data.id` | string | Unique staff member identifier. |
| `data.fullName` | string | Full name. |
| `data.staffType` | string | Staff member type. `employee`, `freelancer`, `contractor` |
| `data.collectionId` | string | Identifier of the collection it belongs to; null if it is in none. |
| `data.collectionName` | string | Collection path it belongs to; null if not applicable. |
| `data.hasDrivingLicense` | boolean | true if they hold a driving licence. |
| `data.showInPlanner` | boolean | true if they appear in the planner of the account. |
| `data.externalRef` | string | External reference for matching with third-party systems; null if it has none. |
| `data.createdAt` | string<date-time> | Creation date in ISO 8601 UTC; null if not recorded. |
| `data.updatedAt` | string<date-time> | Last modification date in ISO 8601 UTC; null if not recorded. |
| `meta` | object | Additional information about the response. |
| `meta.warnings` | object[] | Lifecycle warnings; present only when the operation is deprecated. |
| `meta.warnings.code` | string | Stable warning code. `deprecated` |
| `meta.warnings.message` | string | For people: what is deprecated, until when, and what to use. |
| `meta.warnings.sunset` | string | Day (YYYY-MM-DD) the operation stops being served. |
| `meta.warnings.replacement` | string | `operationId` of the operation to use instead, or null if there is none. |
| `meta.warnings.link` | string | Where the deprecation is documented (the changelog). |

*Example response · 200*

```json
{
  "data": {
    "id": "staff_member_9f3a2b",
    "fullName": "Example full name",
    "staffType": "employee",
    "collectionId": "collection_9f3a2b",
    "collectionName": "Example collection name",
    "hasDrivingLicense": true,
    "showInPlanner": true,
    "externalRef": "Example external ref",
    "createdAt": "2026-09-01T08:00:00.000Z",
    "updatedAt": "2026-09-01T08:00:00.000Z"
  }
}
```

## Errors

| Status | Codes | Meaning |
| --- | --- | --- |
| 400 | `validation_error` | Malformed query or body. `errors[]` lists every offending field with its stable code. |
| 404 | `not_found` | It does not exist or is outside the scope of the API key. |
| 409 | `conflict` | The current state of the resource prevents the operation, a request with that Idempotency-Key is already in progress, or another conditional write (`If-Match`) held the resource for more than five seconds. `errors[0].code` says which: `in_progress` and `lock_timeout` are solved by retrying; `invalid_state` is not, because the state of the resource forbids the operation. |
| 412 | `precondition_failed` | The `If-Match` entity tag does not match the current representation. Read the resource again and retry. |
| 422 | `idempotency_key_reused` | The same key was used before with a different body. Change the key. |

## Deprecation

This operation is not deprecated. Deprecations are announced with a Deprecation header and a sunset date.

---

Canonical URL: https://docs.filmo.io/rest-api/endpoint-reference/staff/update-a-staff-member  
Last updated: 2026-10-25