### Replace a manager's roles

`PUT /api/v1/managers/{id}/roles`

Replaces the whole set. A caller may only grant roles whose permissions are a subset of their own, so this cannot be used to escalate.

- Authentication: manager session (JWT) or API token
- Permission: `prm_roles_manage` (Manage roles & permissions)
- Risk: danger
- Rate limit bucket: `t_mutate`

#### Parameters

| Name | In | Type | Required | Description |
| --- | --- | --- | --- | --- |
| `id` | path | integer | yes | Manager id. |
| `role_ids` | body | array | yes | The complete new set of role ids. |

#### Errors

| Code | Status | When |
| --- | --- | --- |
| `ERR_FORBIDDEN` | 403 | the caller holds an API token — this route refuses machine credentials |

#### Note

This takes effect on every API token that manager holds, immediately and silently. A token's authority is its owner's live permissions intersected with its own scope, so removing a role here shrinks every integration running as that person with no notification and no change to the token record.