Changes the name or settings of the organisation. Send only what changes; other settings stay as they are.
HTTP
PATCH /orgAccess: Session token only. API keys get 403 with insufficient_scope.
Role: Organisation owner or admin.
Request body #
JSON.
| Field | Type | Required | Description |
|---|---|---|---|
name | string | no | A new name. At most 80 characters. |
settings.localization.sourceLanguage | string | no | At most 80 characters. |
settings.localization.timezone | string | no | At most 80 characters. |
settings.localization.messageFormat | string | no | At most 80 characters. |
settings.localization.machineTranslation | string | no | At most 80 characters. |
settings.profile.description | string | no | At most 400 characters. |
settings.profile.industry | string | no | At most 60 characters. |
settings.profile.size | string | no | At most 20 characters. |
settings.security.sessionTimeout | string | no | 1 hour, 4 hours, 8 hours, 24 hours, 7 days or Never. Sessions end after this long without use. |
settings.security.require2fa | boolean | no | Members must use two-factor authentication. You need it on your own account to turn this on, otherwise 422 with fields.require2fa set to mfa_not_enabled. |
settings.security.passwordMinLength | integer | no | The shortest password members may set, 8 to 64. Default 8. |
settings.security.passwordRequireMix | boolean | no | Passwords need an upper case letter, a lower case letter and a digit. |
settings.security.apiKeyMaxDays | integer or null | no | New API keys must expire within this many days, 1 to 3650. null means no limit. Existing keys are not changed. |
settings.security.ipAllowlist | list of string | no | Addresses (203.0.113.7) and ranges (203.0.113.0/24) requests may come from, at most 50. An empty list allows any address. Saving a list that leaves out your own address gives 422 with fields.ipAllowlist set to own_ip_not_allowed. |
settings.security.auditRetentionDays | integer or null | no | Delete audit log entries older than this many days, 30 to 3650. null keeps them for as long as the organisation exists. |
settings.security.dataRegion | string or null | no | Where the organisation wants its data stored: one of us, ca, br, eu, uk, ch, ae, za, in, sg, jp, kr, id or au. null means no preference. The choice is recorded, and the data is moved there as soon as that region is available. A change records org.data_region_changed in the audit log. |
settings.security.restrictDomains | boolean | no | Only allow invitations to the listed domains. |
settings.security.domains | list of string | no | Domains such as @example.com. |
JSON
{ "name": "Acme Inc.", "settings": { "security": { "sessionTimeout": "8 hours" } } }Response 200 #
The organisation after the change, without role.
Response fields #
| Field | Type | Description |
|---|---|---|
id | string | The id of the organisation. |
name | string | The name. |
settings.localization | object | sourceLanguage, timezone, messageFormat and machineTranslation, free text. The app shows the first three; machineTranslation is no longer used, see Machine translation. |
settings.profile | object | description, industry and size. |
settings.security | object | require2fa, restrictDomains and passwordRequireMix (booleans), domains (list of strings such as @example.com), sessionTimeout, passwordMinLength, apiKeyMaxDays, ipAllowlist, auditRetentionDays and dataRegion. |
Errors #
| Status | error | When |
|---|---|---|
| 401 | unauthenticated | The token is missing or not valid. |
| 403 | forbidden | You are not an owner or admin. |
| 422 | invalid_request | A value is empty, too long, not in the list of allowed values, or domains holds something that is not like @example.com. |
| 429 | rate_limited | Too many requests, see Rate limiting. |
See Errors for the error format.