---
title: "Update a company membership"
method: PATCH
path: "/v1/company_memberships/{id}"
tags: ["Company membership"]
---

# Update a company membership

`PATCH /v1/company_memberships/{id}`

## Request

- Base URL: `https://api.cardda.com`
- URL: `https://api.cardda.com/v1/company_memberships/{id}`
- Auth: HTTP bearer

Updates a membership's KYC attributes (`legal_representative`,
`has_powers_to_act`, `partner`, `partner_type`, `participation_rate`,
`is_indirect_participation_corporate`). While the company's
`verification_status` is `pending`/`rejected`, the KYC file fields
(`identification_file`, `power_file`, `pep_file`, `pep_file_template`) are
also writable. `role` is writable only by callers holding the
`members_management` permission.

## Path parameters

- `id` string, required

## Parameters

- `#/paths/~1v1~1users/get/parameters/0` (unresolved $ref)

## Request body

- object
  - `role` string: Requires the `members_management` permission.
  - `legal_representative` boolean
  - `has_powers_to_act` boolean
  - `partner` boolean
  - `partner_type` integer
  - `participation_rate` number
  - `is_indirect_participation_corporate` boolean
  - `identification_file` string
  - `power_file` string
  - `pep_file` string
  - `pep_file_template` string

## Response `200`

The updated membership.

- CompanyMembership: Links a user (or a pending email invitation) to a company with a role and KYC-related attributes (legal representative, partner, participation rate).
  - `id` string, uuid, required
  - `user_id` string, nullable: Firebase UID of the member. Null while the invitation is still pending.
  - `company_id` string, uuid, required
  - `email` string, nullable
  - `role` string: Role name (e.g. `owner`, `admin`, `member`, or a custom company role name).
  - `status` 'pending' | 'active' | 'canceled'
  - `legal_representative` boolean
  - `has_powers_to_act` boolean, nullable
  - `partner` boolean
  - `partner_type` integer, nullable
  - `participation_rate` number, nullable: Ownership participation percentage (0-100).
  - `is_indirect_participation_corporate` boolean, nullable
  - `company_role_id` string, uuid, nullable
  - `permissions` object[]: Permissions granted to the membership (only `id` and `name` are returned). **Only included by the list endpoint** (`GET /v1/company_memberships`); the create/update/destroy/resend/create_many responses do not embed it.
    - `id` string, uuid
    - `name` string
  - `created_at` string, date-time
  - `updated_at` string, date-time

## Other responses

- `401`: Unauthorized
- `404`: Membership not found
- `422`: Validation failed

---

[API](https://skmtc.dev/cardda/apis/organization-api.md) - [All operations](https://skmtc.dev/cardda/apis/organization-api/llms.txt) - [OpenAPI document](https://skmtc.dev/cardda/apis/organization-api/revisions/32a4430278a8?raw)