> ## Documentation Index
> Fetch the complete documentation index at: https://docs.blobhub.io/llms.txt
> Use this file to discover all available pages before exploring further.

# Update Organization

Update an organization's profile and settings.

## **PATCH** `/orgs/:id`

### Path Parameters

| Parameter | Type   | Required | Description                                 |
| :-------- | :----- | :------- | :------------------------------------------ |
| `id`      | string | Yes      | The unique ID or alias of the organization. |

### Request Body

| Parameter     | Type   | Required | Description                      |
| :------------ | :----- | :------- | :------------------------------- |
| `name`        | string | No       | Full name of the organization.   |
| `description` | string | No       | Description of the organization. |
| `url`         | string | No       | Website URL.                     |
| `visibility`  | string | No       | `public` or `private`.           |
| `tags`        | array  | No       | List of string tags.             |

### Response

Returns `{"status": "success"}` — no body beyond the status.

### Errors

| Status | Error                  | Cause                                                                                                 |
| :----- | :--------------------- | :---------------------------------------------------------------------------------------------------- |
| 400    | `invalid_request_body` | An unknown field, or a value of the wrong type.                                                       |
| 403    | `forbidden`            | Missing `write` access to the organization, or — for `visibility` only — no human behind the request. |

### Changing Visibility

`visibility` is the one field on this endpoint that moves the access perimeter: flipping an organization to
`public` exposes it to anonymous readers, and anonymous tokens are freely obtainable. Changing it therefore
requires a human behind the request, and a [service account](/general/service-accounts)'s own key is refused
with `403` — even though the endpoint as a whole only needs `write`, two role levels below every other
perimeter operation.

The guard is narrower than the endpoint, in two ways that matter:

* **It is on the field, not the request.** `name`, `description`, `url` and `tags` are ordinary product work.
  A service account can PATCH any of them, alone or together, and is never refused.
* **It is on an actual change, not on the field's presence.** Sending `visibility` with the value already
  stored moves nothing and is allowed. This is deliberate: an idempotent client that PATCHes its whole desired
  state on every run would otherwise be refused forever for writing back a value that changes nothing.

Both directions are governed — `private` → `public` and `public` → `private` alike. Use an
[acting token](/rest-api/auth/impersonate) when automation has to publish or unpublish on a human's behalf.

### Example

<CodeGroup>
  ```json Request theme={null}
  {
    "description": "Building the future of blobs.",
    "visibility": "public"
  }
  ```

  ```json Response theme={null}
  {
    "status": "success"
  }
  ```
</CodeGroup>