Updates only the fields present in the request body and leaves everything else untouched. Sending null for a nullable field resets it to its default — that is different from omitting the field, which changes nothing. admin, manager and analyst are evaluated as one group: as soon as any of them is present, all three are re-applied, and the ones you did not send count as false. Sending {"manager": true} for an administrator therefore removes their administrator role. Send all three flags together whenever you change roles. Only one of them may be true, otherwise the request is rejected.