# Update the organization

`PATCH https://stylor.ai/api/v1/organization`

- Authentication: private API key, sent as `Authorization: Bearer sgpt-sk-…::…`
- Rate-limit resource: `api.v1.organization.update`
- Demo key: not accepted
- Web page: https://stylor.ai/guides/rest/v1/update-organization

Renames the organization or changes its reporting timezone. Send only
the fields to change, inside `fields`. A field that cannot be changed
here is refused, not ignored.

## Changing the timezone

Analytics days are rebuilt against the new timezone's midnights for as
far back as the rollups are rebuilt, so recent figures move. Older days
keep the boundaries they were counted with.

## Example request

```bash
curl -X PATCH "https://stylor.ai/api/v1/organization" \
  -H "Authorization: Bearer $STYLOR_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
  "fields": {
    "name": "Lovlei Ranch"
  }
}'
```

## Request body

Content type `application/json`, required.

- `fields` (object, required): The fields to change, at least one.
  - `name` (string): 2 to 100 characters once trimmed. [min length 2; max length 100]
  - `reportingTimezone` (string): An IANA timezone, like `America/New_York`.

### Examples

#### Rename

Changes the organization's name only.

```json
{
  "fields": {
    "name": "Lovlei Ranch"
  }
}
```

#### Reporting timezone

Counts analytics days from midnight in Denver.

```json
{
  "fields": {
    "reportingTimezone": "America/Denver"
  }
}
```

## Responses

### 200

The organization as saved.

Content type `application/json`:

- `organization` (Organization, required): An organization.
  - `organizationId` (string (uuid), required): The organization's id.
  - `name` (string, required): The name members see in the dashboard.
  - `creatorId` (string (uuid)): The user who made the organization. Returned by updates only.
  - `reportingTimezone` (string, required): The IANA timezone analytics days are counted in. `UTC` until it is set.
  - `createdAt` (string (date-time)): When it was made.
  - `updatedAt` (string (date-time)): When it last changed.

Example:

```json
{
  "organization": {
    "organizationId": "0a2c1f4e-5b6d-7e8f-9012-3456789abcde",
    "name": "Lovlei Ranch",
    "creatorId": "3f6b0d7e-1c2a-4b5d-8e9f-0a1b2c3d4e5f",
    "reportingTimezone": "America/Denver",
    "createdAt": "2026-09-12T16:02:11.000Z",
    "updatedAt": "2026-10-04T18:20:03.001Z"
  }
}
```

## Errors

Every error is a JSON object with an `error` string. Match on the status code; the message is written for people.

| Status | Message | When |
| --- | --- | --- |
| 400 | Request body must be valid JSON. | The body is not parseable JSON. |
| 400 | Request body must be a JSON object. | The body is empty, an array, or a JSON primitive. |
| 404 | Organization not found | The organization encoded in the API key no longer exists. |
| 422 | fields must be an object. | `fields` is missing, an array, or not an object. |
| 422 | Unknown field: <field>. Allowed fields: name, reportingTimezone. | `fields` names something other than `name` or `reportingTimezone`. |
| 422 | Organization name must be at least 2 characters | `name` is not a string, or shorter than 2 characters once trimmed. |
| 422 | Organization name can be at most 100 characters | `name` is longer than 100 characters once trimmed. |
| 422 | Not a recognised IANA timezone | `reportingTimezone` is not a timezone name the server knows. |
| 422 | No fields to update | `fields` is an empty object. |

### Shared authentication, quota and rate-limit errors

| Status | Message | When |
| --- | --- | --- |
| 401 | API key missing. | The `Authorization` header is absent, is not `Bearer <key>`, or the key does not have three dash-separated segments. |
| 401 | Authentication failed: public key is invalid or not recognized. | A public-key endpoint was called with a key that does not exist. |
| 401 | Authentication failed: private key provided instead of a public key. | A public-key endpoint was called with an `sgpt-sk-…` key. |
| 401 | Authentication failed: token is not recognized. | A private-key endpoint was called with a key whose lookup segment does not exist. |
| 401 | Authentication failed: private key is invalid. | A private-key endpoint was called with a key whose secret does not match. |
| 401 | Authentication failed: public key provided instead of a private key. | A private-key endpoint was called with an `sgpt-pk-…` key. |
| 401 | Authentication failed: bearer token format is invalid. | A private key was sent without its `::` lookup segment. |
| 401 | Authentication failed: API key could not be read. Regenerate the key. | The key's embedded organization data could not be decrypted or parsed. |
| 403 | This key does not have the "<scope>" scope. | A private-key endpoint was called with a key whose scopes do not include the one the endpoint needs. Nothing is counted against your quota. See Authentication. |
| 403 | This key's scopes do not cover this endpoint. | A key with scopes called a private endpoint that no scope grants yet. Give the key every scope to reach it. |
| 403 | Demo mode is not available for private-key routes. Demos are only supported with public API keys. | The demo key was sent to a private-key endpoint. |
| 403 | Demo mode is not supported on this API route. Check the documentation for available demo endpoints. | The demo key was sent to a public-key endpoint that opts out of demo mode. |
| 403 | No active subscription for this organization. | The organization that owns the key has no active subscription. |
| 403 | No quota found for organization "<organizationId>". | The organization has no quota record for the current billing period. |
| 403 | No entitlement for "<resource>". | The plan's quota template has no entry for this endpoint. |
| 403 | Access denied to "<resource>". | The plan's quota template turns this endpoint off. |
| 429 | Monthly quota exceeded for "<resource>" (<quota>/<quota> used). | The billing-period quota for this endpoint is exhausted. `Retry-After` gives the seconds until the period resets. |
| 429 | RPM limit exceeded for "<resource>" (<used>/<limit> used). | More than the allowed requests per minute were sent. `Retry-After` is 60. |
| 500 | Internal server error. | An unexpected failure on the server. The message is always this string; details are logged, never returned. Quota consumed by the request is refunded, as it is for every 5xx response. |