Update membership for a subaccount. Optional roles: omit the field to leave roles unchanged. Only roles for products included in the request are changed. Optional email, firstName, and/or lastName update the member; omitted fields keep the existing stored value. When updating email, set emailVerified to true if the partner has already verified the new address (skips the confirmation email and marks the address confirmed); omit emailVerified or set it to false to send a confirmation link to the new address. Email changes apply to the underlying user and propagate to connected apps via SNS (UserUpdated). Email cannot be changed for pending invitations, IdP-managed users, users who belong to other organizations, users with pending invitations elsewhere, or when the email-change rate limit applies.