Allowed Scopes: experimental:user:role:manage

Make a user of the company the token resolves to a requester or a controller in that company: the user gets that role and loses the other one. Only users whose roles in the company are requester and/or controller can be changed, and never the user the token acts on behalf of, so the admin and accountOwner roles are never granted or removed. Companies whose users are managed by an HRIS integration are refused.

Send the user's roles as you last read them (roles on the user) in currentRoles: the change is only applied if they still are the user's roles. Otherwise, because the roles were changed in the meantime, 409 is returned and nothing changes: read the user again and decide whether to retry. Asking for the role the user already has changes nothing.