---
title: "Update the org's OTLP export configuration"
method: PATCH
path: "/v1/org/settings/otel-export"
tags: ["Observability"]
---

# Update the org's OTLP export configuration

`PATCH /v1/org/settings/otel-export`

## Request

- Base URL: `https://api.1claw.co`
- URL: `https://api.1claw.co/v1/org/settings/otel-export`
- Auth: HTTP bearer

Every field is optional and only present fields change. The endpoint is validated *and DNS-resolved* on save: HTTPS only, no embedded credentials, and refused if any resolved address is private, loopback, link-local, metadata or ULA. A URL that resolves to a private address is the SSRF, and it is refused here rather than left in the database looking configured.

`headers` replaces the whole map when present and is encrypted at rest under the org's key. Omit it to change other fields without touching stored header values you cannot read back.

Transport is OTLP over HTTP with JSON encoding, posted to `<endpoint>/v1/traces`, `/v1/metrics` and `/v1/logs`. What leaves is exactly what the org's own dashboard stream carries — signals already through the collector's redaction pass.

## Request body

- object
  - `enabled` boolean
  - `endpoint` string, uri: HTTPS only.
  - `headers` object: Sent on every export request, e.g. an Authorization header. Reserved hop-by-hop names are refused.
  - `resource_attributes` object
  - `signal_filter` string[]

## Response `200`

The updated config, header names only

## Other responses

- `400`: Endpoint refused (scheme, credentials, private or unresolvable host), reserved header, or enabling with no endpoint
- `401`: Unauthenticated
- `402`: Requires the Team plan or higher
- `403`: Not an owner or admin

---

[API](https://skmtc.dev/1claw/apis/1claw-api.md) · [All operations](https://skmtc.dev/1claw/apis/1claw-api/llms.txt) · [OpenAPI document](https://skmtc.dev/1claw/apis/1claw-api/revisions/ae109b496830?raw)