---
title: "Set or replace a company variable"
method: PUT
path: "/api-regulated/v1/introducing-brokers/{introducingBrokerId}/companies/{companyId}/variables"
tags: ["Company"]
---

# Set or replace a company variable

`PUT /api-regulated/v1/introducing-brokers/{introducingBrokerId}/companies/{companyId}/variables`

## Request

- Base URL: `https://api.currencyguard.com`
- URL: `https://api.currencyguard.com/api-regulated/v1/introducing-brokers/{introducingBrokerId}/companies/{companyId}/variables`
- Auth: OAuth 2 (implicit, authorization URL `https://auth.currencyguard.com/oauth2/authorize`, scopes: `regulated.parties.canModifyCompany`)

Upserts one variable by name. Replace rather than create-or-update because a caller setting a name that already exists is always the operation wanted; there is no separate create.

**Required entitlement:** `regulated.parties.canModifyCompany`  
_Entitles the regulated user to modify company information for their customer accounts_

## Path parameters

- `introducingBrokerId` string, uuid, required
- `companyId` string, uuid, required

## Request body

- EntityVariableDTOUpsert: Set or replace one company variable.
  - `name` string, required: The variable name. Uppercase letters, digits and underscores only. Names ending in _PASSWORD, _SECRET, _TOKEN or _KEY are treated as secret and obscured on screen until revealed.
  - `value` string: The value to store.

## Response `200`

Variable stored; returns the full variable list

- EntityVariableDTO[]
  - `name` string: The variable name.
  - `value` string: The value. Returned for secret variables too — this endpoint is the one place a credential is served, and clients are expected to obscure it until the user reveals it.
  - `secret` boolean: Whether this variable is a credential and must be obscured on screen until revealed. True for any name ending in _PASSWORD, _SECRET, _TOKEN or _KEY.

## Other responses

- `400`: Invalid variable name or value — [`http/malformed-request`](/problems/http/malformed-request/)
- `401`: Not authenticated — [`security/authentication-failed`](/problems/security/authentication-failed/)
- `403`: Not authorized - requires REGULATED role or company not in your regulated entity — [`security/insufficient-permissions`](/problems/security/insufficient-permissions/)
- `404`: Company not found — [`http/resource-not-found`](/problems/http/resource-not-found/)
- `500`: Internal server error — [`server/internal-error`](/problems/server/internal-error/)

---

[API](https://skmtc.dev/currencyguard/apis/currencyguard-trading-system-api-external.md) · [All operations](https://skmtc.dev/currencyguard/apis/currencyguard-trading-system-api-external/llms.txt) · [OpenAPI document](https://skmtc.dev/currencyguard/apis/currencyguard-trading-system-api-external/revisions/a1f3f854190d?raw)