update_customer
Update customer settings and contact details via merge-patch, covering currency, MFA requirement, allowed invite domains, contact emails, and URL slug.
Instructions
Read and update your organization's general settings. Partially updates the general settings and contact info of the customer identified by {customerId}. {customerId} must match the customer resolved from the bearer token; a token scoped to a different customer gets 403, even if that customer would otherwise be reachable through a reseller/MTS relationship. Requires the Settings permission and DoiT API access (platform:externalApi); updating allowedInviteDomains additionally requires the UsersManager permission.
The request body must use application/merge-patch+json (RFC 7396): an omitted field leaves the current value unchanged, and an explicit null also leaves it unchanged, except for urlSlug, where an explicit empty string removes the customer's active URL slug rather than leaving it unchanged.
Fields are nested exactly as getCustomer returns them - currency and allowedInviteDomains under settings, emails under contact - so every value is read and written at the same path. settings.currency accepts only the codes listed in the schema and cannot be cleared; allowedInviteDomains and contact.emails are cleared with an empty array.
Input Schema
| Name | Required | Description | Default |
|---|---|---|---|
| contact | No | Customer point-of-contact details. Shared by the `getCustomer` response and the `updateCustomer` request body so a value is always read and written at the same path. | |
| urlSlug | No | The customer's URL display name. An explicit empty string removes the active slug; a non-empty value must be 3-12 characters of lowercase letters, digits, or dashes, starting and ending with a letter or digit, and must be unique across all customers. | |
| settings | No | Customer settings. Shared by the `getCustomer` response and the `updateCustomer` request body so a value is always read and written at the same path. `currency` accepts only the listed codes; any other value is rejected with `400`. Unlike `urlSlug` and `allowedInviteDomains` it cannot be cleared - no value unsets it. | |
| customerId | Yes | ||
| customerContext | No | Scope the request to a specific customer by ID. Required for DoiT employees (whose token isn't tied to a single customer); omit for direct customer users. |