> ## Documentation Index > Fetch the complete documentation index at: https://docs.cookiechimp.com/docs/llms.txt > Use this file to discover all available pages before exploring further. # Update account > Update an account's settings — the same fields the dashboard's account settings screens expose. An account token carries the account's own authority. A user token must belong to an admin of the account, mirroring the web UI, and a non-admin member gets a `403`. `account_type` cannot be changed here, as on the web form: mobile app accounts are only created through the admin panel. ## OpenAPI ````yaml patch /accounts/{id} openapi: 3.1.0 info: title: CookieChimp API description: | API for CookieChimp.com. ## Request bodies Resource endpoints expect the resource wrapped under its own key, e.g. `{"category": {"name": "Analytics"}}` rather than a bare object. `PUT /password` wraps in `user`. Two endpoints take their body unwrapped: `POST /auth`, which takes `email` and `password` at the top level, and `POST /consent-banners/from-template`, which takes `jurisdiction_id` — a selector for which template to build from, not an attribute of the banner it creates. ## Response envelopes Listing endpoints — including `GET /groups` and `GET /accounts` — return `{"pagination": {...}, "data": [...]}`. `GET /banner-templates` is the exception: it returns `{"data": [...]}` with no pagination, being a fixed catalogue rather than a collection of the account's records. Most single-resource endpoints return `{"data": {...}}`; a single group or account is returned unwrapped. Resource-deletion endpoints return `{"message": "..."}`; `DELETE /auth` returns an empty object. version: 1.2.0 servers: - url: https://cookiechimp.com/api/v1 security: - authorization: [] paths: /accounts/{id}: patch: tags: - Accounts summary: Update account description: | Update an account's settings — the same fields the dashboard's account settings screens expose. An account token carries the account's own authority. A user token must belong to an admin of the account, mirroring the web UI, and a non-admin member gets a `403`. `account_type` cannot be changed here, as on the web form: mobile app accounts are only created through the admin panel. operationId: updateAccount parameters: - $ref: '#/components/parameters/id' requestBody: description: Account settings to update required: true content: application/json: schema: $ref: '#/components/schemas/AccountWriteRequest' responses: '200': description: Updated account content: application/json: schema: $ref: '#/components/schemas/Account' '401': $ref: '#/components/responses/Unauthorized' '403': $ref: '#/components/responses/AccountAdminRequired' '404': $ref: '#/components/responses/NotFound' '422': $ref: '#/components/responses/ValidationError' '429': $ref: '#/components/responses/RateLimited' components: parameters: id: name: id in: path description: ID of the resource required: true schema: type: string schemas: AccountWriteRequest: type: object properties: account: $ref: '#/components/schemas/AccountWrite' required: - account example: account: name: example.com support_email: privacy@example.com banner_debug_mode: false Account: type: object properties: id: type: string readOnly: true description: Unique identifier for the account name: type: string readOnly: true description: Domain of the account account_type: type: string enum: - website - mobile_app readOnly: true domain: type: - string - 'null' subdomain: type: - string - 'null' default_language: type: string description: ISO 639-1 code the banner falls back to auto_translate: type: boolean translations: type: array items: type: string description: ISO 639-1 codes the banner is translated into industry: type: - string - 'null' description: type: - string - 'null' support_email: type: - string - 'null' banner_debug_mode: type: boolean blocking_mode: type: - string - 'null' retain_consent_duration: type: integer description: Years consent records are retained allowed_domains: type: array items: type: string readOnly: true description: List of allowed domains the script will run on owner_id: type: string readOnly: true description: ID of the account user that owns the account onboarding_status: type: - string - 'null' readOnly: true description: > The status of the account, where: - `account_created`: The account has been created. - `vendors_setup`: Categories, services or TCF vendors have been set up. - `script_installed`: The script has been installed on the user's website. - `live`: The account is live and operational. `null` means the status could not be determined — the analytics store behind it was unreachable when the response was built. It is not a statement about the account, and the request itself still succeeded. Treat it as "unknown" and retry rather than as a downgrade in status. visitor_stats: $ref: '#/components/schemas/VisitorStats' created_at: type: string format: date-time readOnly: true description: Date and time when the account was created updated_at: type: string format: date-time readOnly: true description: Date and time when the account was last updated example: id: abc123 name: example.com allowed_domains: - example.net - example.org owner_id: xyz123 onboarding_status: live visitor_stats: comparison: vs. Last 30 days statistics: consents: count: 213 rate_of_change: 25.29 unique_visitors: count: 895 rate_of_change: 42.06 consent_rate: count: 23.8 rate_of_change: -11.85 raw_data: consents: current_period: 213 previous_period: 170 unique_visitors: current_period: 895 previous_period: 630 consent_rate: current_period: 23.8 previous_period: 27 created_at: '2022-12-20T18:45:00Z' updated_at: '2023-01-10T19:00:00Z' AccountWrite: type: object properties: name: type: string description: | The account's domain. Must be a valid domain for website accounts. domain: type: string subdomain: type: string default_language: type: string description: ISO 639-1 code the banner falls back to auto_translate: type: boolean description: >- Whether new content is machine-translated into the account's languages translations: type: array items: type: string description: ISO 639-1 codes the banner is translated into allowed_domains_list: type: string description: | Comma-separated list of domains the script may run on. Write-only — responses return the parsed `allowed_domains` array instead. industry: type: string description: type: string support_email: type: string format: email banner_debug_mode: type: boolean blocking_mode: type: string description: How aggressively scripts are blocked before consent retain_consent_duration: type: integer description: | Years consent records are retained. Free accounts are fixed at 3. VisitorStats: type: - object - 'null' description: | Visitor analytics for the last 30 days, compared against the 30 days before that. `null` when the client passed `?visitor_stats=false`. properties: comparison: type: string description: Label for the comparison period statistics: type: object properties: consents: $ref: '#/components/schemas/VisitorStatsMetric' unique_visitors: $ref: '#/components/schemas/VisitorStatsMetric' consent_rate: $ref: '#/components/schemas/VisitorStatsMetric' raw_data: type: object properties: consents: $ref: '#/components/schemas/VisitorStatsRawMetric' unique_visitors: $ref: '#/components/schemas/VisitorStatsRawMetric' consent_rate: $ref: '#/components/schemas/VisitorStatsRawMetric' Error: type: object description: | The standard error envelope, used for authentication, authorization, pagination and not-found errors. properties: errors: type: array items: type: object properties: code: type: integer message: type: string example: errors: - code: 401 message: Invalid API Key ValidationError: type: object description: | Returned when a create or update fails validation. Each entry carries a single human-readable `error` string. properties: errors: type: array items: type: object properties: error: type: string example: errors: - error: Name can't be blank VisitorStatsMetric: type: object properties: count: type: number description: Value for the current period rate_of_change: type: number description: Percentage change against the comparison period VisitorStatsRawMetric: type: object properties: current_period: type: number previous_period: type: number responses: Unauthorized: description: Missing, invalid or expired API token content: application/json: schema: $ref: '#/components/schemas/Error' example: errors: - code: 401 message: Invalid API Key AccountAdminRequired: description: | The token resolved to a user who is not an admin of this account. Configuration changes are admin-only, mirroring the dashboard — a group admin qualifies even without a direct membership, since a group role supersedes one. Account tokens carry the account's own authority and never see this; reads are unaffected. content: application/json: schema: $ref: '#/components/schemas/Error' example: errors: - code: 403 message: User must be an admin of this account NotFound: description: The record does not exist, or does not belong to the caller content: application/json: schema: $ref: '#/components/schemas/Error' example: errors: - code: 404 message: Record not found ValidationError: description: The record could not be saved content: application/json: schema: $ref: '#/components/schemas/ValidationError' RateLimited: description: | Too many requests. The general limit is 300 requests per 5 minutes per API token; the auth endpoints are throttled more tightly per IP. headers: Retry-After: description: Seconds until the current rate-limit window resets schema: type: integer content: application/json: schema: $ref: '#/components/schemas/Error' example: errors: - code: 429 message: Too many requests. Please retry later. securitySchemes: authorization: type: http scheme: bearer description: API token obtained from the login endpoint or the dashboard ````