# Update an organization

`PATCH /fapi/v1/organizations/{org_id}` · called from the environment's sign-in host

Changes the name, slug or brand color of an organization (JSON merge patch, RFC 7396). Metadata, the external ID and the membership limit cannot be changed here. Requires the authenticated user's `__Host-idp_session` cookie; if the cookie is missing, expired, or revoked, returns `401 unauthenticated`. A first-party app on another origin can instead send its front API access token (`Authorization: DPoP <token>` with a DPoP proof; see [Front API access token](/docs/api/fapi/front-api-token)). The user must be an active member of the organization with the `idp_org:update` permission. A user who is not a member gets `404 not_found`; a member without the permission gets `403 insufficient_permissions`.

With `@keenauth/js`: `await keenauth.organizations.update(orgId, { name: "Acme Inc" }, { expectedVersion: 4 })`.

## Request

Headers:

| Header | Required | Description |
| --- | --- | --- |
| `Idp-Client` | yes | SDK identifier. |
| `Origin` | yes, with the cookie | Must be exactly `https://<sign-in host>`. |
| `Content-Type` | yes | `application/json` or `application/merge-patch+json`. |
| `If-Match` | no | `"<version>"` of the organization as last read; if it has changed since, returns `412 precondition_failed` and nothing changes. |

`org_id`: the organization identifier (`org_…`).

Body (at least one field):

| Field | Required | Description |
| --- | --- | --- |
| `name` | no | New display name; cannot be `null`. |
| `slug` | no | New slug; cannot be `null`. The old slug stays reserved for 90 days, and a slug can change once in 30 days. |
| `brand_color` | no | `#RRGGBB`; `null` clears it. |

## Response

`200 OK` with a new `ETag`; the body is the organization (see [Get an organization](./get)).

## Errors

| Status | Code | When |
| --- | --- | --- |
| 400 | `unknown_field` | The body has a field other than `name`, `slug` and `brand_color`. |
| 401 | `unauthenticated` | No valid session cookie. |
| 403 | `origin_not_allowed` | `Origin` is missing or wrong. |
| 403 | `insufficient_permissions` | The user lacks `idp_org:update` in the organization. |
| 404 | `not_found` | No such organization for this user; an unknown, malformed or foreign identifier answers the same. |
| 409 | `slug_taken` | Another organization uses the slug. |
| 409 | `slug_reserved` | The slug is in another organization's 90-day reservation. |
| 409 | `slug_change_rate_limited` | The slug already changed in the last 30 days. |
| 409 | `organization_disabled` | The organization is disabled. |
| 409 | `organization_pending_deletion` | The organization is scheduled for deletion. |
| 412 | `precondition_failed` | `If-Match` does not name the current version, or the organization changed while the request was processed. |
| 422 | `validation_failed` | A field is invalid or `null` where not allowed, or the patch is empty (`empty_patch`). |
| 503 | `service_unavailable` | Temporarily unavailable; retry after `Retry-After`. |

## Example

```bash
curl -X PATCH https://example.keenauth.app/fapi/v1/organizations/org_01jbz6x8kq3m2n4p5r6s7t8v9a \
  -H "Idp-Client: my-app/1.0.0 (node/22.0.0)" \
  -H "Origin: https://example.keenauth.app" \
  -H "Content-Type: application/merge-patch+json" \
  -H 'If-Match: "4"' \
  -b cookies.txt \
  -d '{"name": "Acme Inc", "brand_color": null}'
```

The response has the same shape as [Get an organization](./get), with `"version": 5`.