---
title: "Update a company membership"
method: PATCH
path: "/v1/company_memberships/{id}"
tags: ["Company membership"]
---

# Update a company membership

`PATCH /v1/company_memberships/{id}`

Updates a membership's KYC attributes (`legal_representative`,
`has_powers_to_act`, `partner`, `partner_type`, `participation_rate`,
`is_indirect_participation_corporate`). While the company's
`verification_status` is `pending`/`rejected`, the KYC file fields
(`identification_file`, `power_file`, `pep_file`, `pep_file_template`) are
also writable. `role` is writable only by callers holding the
`members_management` permission.

## Path parameters

- `id` string, required

## Parameters

- `#/paths/~1v1~1users/get/parameters/0` — unresolved $ref

## Request body

- object
  - `role` string — Requires the `members_management` permission.
  - `legal_representative` boolean
  - `has_powers_to_act` boolean
  - `partner` boolean
  - `partner_type` integer
  - `participation_rate` number
  - `is_indirect_participation_corporate` boolean
  - `identification_file` string
  - `power_file` string
  - `pep_file` string
  - `pep_file_template` string

## Response `200`

The updated membership.

- CompanyMembership — Links a user (or a pending email invitation) to a company with a role and KYC-related attributes (legal representative, partner, participation rate).
  - `id` string, uuid, required
  - `user_id` string, nullable — Firebase UID of the member. Null while the invitation is still pending.
  - `company_id` string, uuid, required
  - `email` string, nullable
  - `role` string — Role name (e.g. `owner`, `admin`, `member`, or a custom company role name).
  - `status` 'pending' | 'active' | 'canceled'
  - `legal_representative` boolean
  - `has_powers_to_act` boolean, nullable
  - `partner` boolean
  - `partner_type` integer, nullable
  - `participation_rate` number, nullable — Ownership participation percentage (0-100).
  - `is_indirect_participation_corporate` boolean, nullable
  - `company_role_id` string, uuid, nullable
  - `permissions` object[] — Permissions granted to the membership (only `id` and `name` are returned). **Only included by the list endpoint** (`GET /v1/company_memberships`); the create/update/destroy/resend/create_many responses do not embed it.
    - `id` string, uuid
    - `name` string
  - `created_at` string, date-time
  - `updated_at` string, date-time

## Other responses

- `401` — Unauthorized
- `404` — Membership not found
- `422` — Validation failed

---

[API](https://skmtc.dev/cardda/apis/banking-api.md) · [All operations](https://skmtc.dev/cardda/apis/banking-api/llms.txt) · [OpenAPI document](https://skmtc-service-production.skmtc.workers.dev/v1/apis/cardda/banking-api/revisions/ff1aeb3fda8b/schema)