Update company settings
Update an allowlist of profile/contact/socials/signing fields. Plan, billing, subscription, permissions, credits, and verification fields are never settable (mass-assignment guard); unknown/forbidden keys are ignored. A patch with no allowlisted field is 400.
Authorizations
OAuth 2.1 authorization code + PKCE (S256). Tokens are tenant-bound (company_id) and scoped. Discover endpoints via /.well-known/oauth-authorization-server.
Headers
Client-chosen key; replaying the same key + body returns the original response, a different body returns 409.
Body
Allowlist of settable profile/contact/socials/signing fields. Plan, billing, subscription, permissions, credits, and verification fields are never settable; unknown/forbidden keys are ignored. A patch with no allowlisted field is 400.
Response
The refreshed settings.
The token tenant's settings — an allowlisted projection of the company profile (only fields present on the doc are returned). Permissive.