--- a/controllers/routes.go	Thu Jul 26 13:47:38 2018 +0200
+++ b/controllers/routes.go	Thu Jul 26 15:42:57 2018 +0200
@@ -14,6 +14,7 @@
 
 	sysAdmin := auth.EnsureRole("sys_admin")
 
+	api.Handle("/users/{user}", sysAdmin(updateUser)).Methods(http.MethodPut)
 	api.Handle("/users", sysAdmin(createUser)).Methods(http.MethodPost)
 
 	api.HandleFunc("/login", login).

--- a/controllers/user.go	Thu Jul 26 13:47:38 2018 +0200
+++ b/controllers/user.go	Thu Jul 26 15:42:57 2018 +0200
@@ -10,6 +10,7 @@
 	"strings"
 
 	"gemma.intevation.de/gemma/auth"
+	"github.com/gorilla/mux"
 	"github.com/jackc/pgx"
 )
 
@@ -39,6 +40,10 @@
 	createUserSQL       = `SELECT sys_admin.create_user($1, $2, $3, $4, NULL, $5)`
 	createUserExtentSQL = `SELECT sys_admin.create_user($1, $2, $3, $4,
   ST_MakeBox2D(ST_Point($5, $6), ST_Point($7, $8)), $9)`
+
+	updateUserSQL       = `SELECT sys_admin.update_user($1, $2, $3, $4, $5, NULL, $6)`
+	updateUserExtentSQL = `SELECT sys_admin.update_user($1, $2, $3, $4, $5,
+  ST_MakeBox2D(ST_Point($6, $7), ST_Point($8, $9)), $10)`
 )
 
 var (
@@ -115,6 +120,78 @@
 	return errNoValidRole
 }
 
+func updateUser(rw http.ResponseWriter, req *http.Request) {
+
+	user := mux.Vars(req)["user"]
+	if user == "" {
+		http.Error(rw, "error: user empty", http.StatusBadRequest)
+		return
+	}
+
+	var newUser User
+
+	defer req.Body.Close()
+	if err := json.NewDecoder(req.Body).Decode(&newUser); err != nil {
+		http.Error(rw, "error: "+err.Error(), http.StatusBadRequest)
+		return
+	}
+
+	token, _ := auth.GetToken(req)
+	err := auth.ConnPool.Do(token, func(db *sql.DB) (err error) {
+		if newUser.Extent == nil {
+			_, err = db.Exec(
+				updateUserSQL,
+				user,
+				string(newUser.Role),
+				newUser.User,
+				newUser.Password,
+				string(newUser.Country),
+				string(newUser.Email),
+			)
+		} else {
+			_, err = db.Exec(
+				updateUserExtentSQL,
+				user,
+				string(newUser.Role),
+				newUser.User,
+				newUser.Password,
+				string(newUser.Country),
+				newUser.Extent.X1, newUser.Extent.Y1,
+				newUser.Extent.X2, newUser.Extent.Y2,
+				string(newUser.Email),
+			)
+		}
+		return
+	})
+
+	var res struct {
+		Result  string `json:"result"`
+		Code    string `json:"code,omitempty"`
+		Message string `json:"message,omitempty"`
+	}
+
+	if err != nil {
+		if pgErr, ok := err.(pgx.PgError); ok {
+			res.Result = "failure"
+			res.Code = pgErr.Code
+			res.Message = pgErr.Message
+		} else {
+			log.Printf("err: %v\n", err)
+			http.Error(rw,
+				"error: "+err.Error(),
+				http.StatusInternalServerError)
+			return
+		}
+	} else {
+		res.Result = "success"
+	}
+
+	rw.Header().Set("Content-Type", "application/json")
+	if err := json.NewEncoder(rw).Encode(&res); err != nil {
+		log.Printf("error: %v\n", err)
+	}
+}
+
 func createUser(rw http.ResponseWriter, req *http.Request) {
 
 	var user User