Request body for PUT Users/{id} (update) and POST UserGroups/{userGroupID}/Users (create in group).
Only BeyondInsight and Application user types can be updated; ActiveDirectory, EntraID, and LDAP users cannot be modified.
Fields honored by the API (all except Password and AccessPolicyID are inherited from UserModel):
UserName, FirstName, LastName, EmailAddress are applied to both BeyondInsight and Application users.
Password is applied to both types (complexity checks are enforced for BeyondInsight users; skipped for Application users).
AccessPolicyID is applied only when updating existing Application users (ignored on create and for BeyondInsight users).
UserType: on update, the client-supplied value is ignored (overwritten with the existing user's type); on create, parsed during validation but not persisted.
IsQuarantined and IsActive are not mapped by these endpoints and will be ignored if provided.
DomainName is used for duplicate username detection but not persisted. DistinguishedName is not used.