---
title: "BIZ-007 §7 — flip an enterprise lead's contact status (audited, admin-gated)"
method: PATCH
path: "/api/v1/admin/waitlists/enterprise/{entry_id}"
tags: ["admin"]
---

# BIZ-007 §7 — flip an enterprise lead's contact status (audited, admin-gated)

`PATCH /api/v1/admin/waitlists/enterprise/{entry_id}`

## Request

- Base URL: `https://api.badgeia.com`
- URL: `https://api.badgeia.com/api/v1/admin/waitlists/enterprise/{entry_id}`
- Auth: none declared

Set or clear ``contacted_at`` on one enterprise-waitlist entry.

``{"contacted": true}`` stamps ``contacted_at`` with the SERVER clock;
``{"contacted": false}`` clears it (undo). The client never supplies a
timestamp — a forged/skewed client clock can't land in the row.

Non-destructive → a plain toggle, no confirm contract. But it IS a mutation
on the operator surface, so it writes an ``auth_audit_log`` row via the
fail-closed ``_audit_or_500`` wrapper (ADMIN-OPS-001 pattern): actor =
admin (user_id + email), and ``detail`` carries the target id + the new
boolean state ONLY — never the prospect's email (lead PII stays out of the
trail). Idempotent: flipping to the current state still returns 200 (with
``changed=false``) and still audits the deliberate action.

Pro waitlist is intentionally NOT mutable here — its ``notified_at`` has
launch-notify semantics driven by a one-shot script, a different lifecycle.

Auth: anonymous → 401, non-admin → 403, admin → 200. Flag-off → 404 (rule #4).
Unknown id → 404.

## Path parameters

- `entry_id` string, uuid, required

## Request body

- AdminWaitlistContactPatch: Body for PATCH /admin/waitlists/enterprise/{id} (BIZ-007 §7 tracking). A single required boolean. ``contacted=true`` stamps ``contacted_at`` with the SERVER's clock; ``contacted=false`` clears it (undo). The client never supplies a timestamp — the handler owns it — so a skewed or forged client clock can't land in the row. Not-destructive → a plain toggle, no confirm contract (unlike the erasure request above).
  - `contacted` boolean, required

## Response `200`

Successful Response

- object

## Other responses

- `422`: Validation Error

---

[API](https://skmtc.dev/badgeia/apis/badge.md) · [All operations](https://skmtc.dev/badgeia/apis/badge/llms.txt) · [OpenAPI document](https://skmtc.dev/badgeia/apis/badge/revisions/7e7f7fee8b77?raw)