---
title: "Update org-level policy settings."
method: PATCH
path: "/v1/orgs/{orgId}/settings"
tags: ["members"]
---

# Update org-level policy settings.

`PATCH /v1/orgs/{orgId}/settings`

## Request

- Base URL: `http://localhost:8080`
- URL: `http://localhost:8080/v1/orgs/{orgId}/settings`
- Auth: one of:
  - API key in cookie `dvt_session`
  - HTTP bearer

Toggles org-level policy flags. Each field has its own capability requirement — the path `orgId` must always match the caller's own organization. Exposes `allowMemberApiKeys` (DVT-342, requires `apikey:manage`): when true, non-admin members may create, list, and revoke their own API keys. Also exposes `linkedSheetsEnabled` (ADR-0078 R1, DVT-2935/DVT-3220, requires `connection:manage`): the admin kill switch for native linked sheets in snowflake mode, replacing the per-connection `linkedBaseOptIn` ack. On by default (DVT-5637): an unset value reads true; send false to turn linked sheets off. Also exposes `claudeOauthClientId` (DVT-5116, requires `connection:manage`): the org's company Claude connector OAuth client ID. At least one field must be present; several may be set in the same request if the caller holds every required capability.

## Request body

- object
  - `allowMemberApiKeys` boolean: When true, members may create their own API keys without the admin or owner role. Admins/owners always retain full key management regardless.
  - `linkedSheetsEnabled` boolean: When true, the org may use native linked sheets in snowflake mode (ADR-0078 R1, DVT-2935/DVT-3220). Requires `connection:manage`.
  - `claudeOauthClientId` string: The org's company Claude connector OAuth client ID (DVT-5116). Trimmed server-side; an empty (or whitespace-only) string clears it. Non-empty values must be at most 256 characters matching `^[A-Za-z0-9+/=._-]+$`. Not a secret — shown to every org member on `GET /v1/me` → `org.claudeOauthClientId`. Requires `connection:manage`.

## Response `200`

Settings updated.

- object
  - `data` object
    - `allowMemberApiKeys` boolean
    - `linkedSheetsEnabled` boolean
    - `claudeOauthClientId` string: The stored (trimmed) client ID; "" when it was cleared. Present only when sent.
  - `meta` Meta: Response metadata.
    - `requestId` string, required: Correlates with the X-Request-Id header.
    - `total` integer: Item count, present on collection responses.
    - `nextCursor` string, nullable: Opaque keyset-pagination cursor, present on paginated responses (e.g. GET /v1/dashboards) when more rows exist beyond this page. Pass it back as the `cursor` query param to fetch the next page; absent or null on the last page.
    - `roleResolveDegraded` boolean: Snowflake mode only (DVT-2260), on GET /v1/dashboards: present and true when the caller's live Snowflake role resolution failed or was unavailable — role-shared dashboards may be missing from this page. Omitted (not merely false) whenever resolution succeeded or the role-share arm does not apply (off snowflake mode, an org admin/owner, or off the ingress listener).

## Other responses

- `400`: Malformed request.
- `401`: Missing, invalid, or expired session.
- `403`: The caller's role does not permit this action.
- `404`: Resource does not exist.

---

[API](https://skmtc.dev/dvt/apis/dvt-rest-api.md) · [All operations](https://skmtc.dev/dvt/apis/dvt-rest-api/llms.txt) · [OpenAPI document](https://skmtc.dev/dvt/apis/dvt-rest-api/revisions/00016f504165?raw)