---
title: "Update Access Control Settings"
method: PATCH
path: "/thermostats/{thermostatId}/accessControl"
tags: ["thermostats"]
---

# Update Access Control Settings

`PATCH /thermostats/{thermostatId}/accessControl`

## Request

- Base URL: `https://api.sb.ecobee.com/api/v2`
- URL: `https://api.sb.ecobee.com/api/v2/thermostats/{thermostatId}/accessControl`
- Auth: OAuth 2
  - Client credentials
  - Token URL: `https://api.sb.ecobee.com/api/v2/token` scopes: `write:thermostat`

Enable or disable password protection on a thermostat.

## Request body

- ThermostatAccessControl
  - `enabled` boolean, required: Indicates if some of the functionality on the thermostat is passcode protected. When this is false, all functionality on the thermostat can be controlled without the passcode.
  - `passcode` string: The 4-digit user access code for the thermostat. The passcode must be set when enabling access control.
  - `passcodeProtected` object: Specifies which functionality on the thermostat requires a passcode. When there is no passcode, this block is omitted.
    - `temperature` boolean, required: Indicates if changing the temperature on the thermostat requires a passcode. This is value always false when the access control is disabled (i.e., when there is no passcode).
    - `systemMode` boolean, required: Indicates if accessing the thermostat system and settings requires a passcode. This is value always false when the access control is disabled (i.e., when there is no passcode).
    - `schedule` boolean, required: Indicates if altering the schedule on the thermostat requires a passcode. This is value always false when the access control is disabled (i.e., when there is no passcode).
    - `vacation` boolean, required: Indicates if altering the vacation functionality requires a passcode. This value is always false when the access control is disabled (i.e., when there is no passcode).
    - `other` boolean, required: Indicates whether a passcode is required to change additional settings. These settings include speaker volume, date and time, Wi-Fi, HomeKit, installation settings, passcode settings on the device, and reset options (such as registration reset and schedule/comfort settings reset). This value is always false when access control is disabled (i.e., when no passcode is set).

## Response `200`

Success

- ThermostatAccessControlResponse
  - `status` 'success'
  - `data` ThermostatAccessControl
    - `enabled` boolean, required: Indicates if some of the functionality on the thermostat is passcode protected. When this is false, all functionality on the thermostat can be controlled without the passcode.
    - `passcode` string: The 4-digit user access code for the thermostat. The passcode must be set when enabling access control.
    - `passcodeProtected` object: Specifies which functionality on the thermostat requires a passcode. When there is no passcode, this block is omitted.
      - `temperature` boolean, required: Indicates if changing the temperature on the thermostat requires a passcode. This is value always false when the access control is disabled (i.e., when there is no passcode).
      - `systemMode` boolean, required: Indicates if accessing the thermostat system and settings requires a passcode. This is value always false when the access control is disabled (i.e., when there is no passcode).
      - `schedule` boolean, required: Indicates if altering the schedule on the thermostat requires a passcode. This is value always false when the access control is disabled (i.e., when there is no passcode).
      - `vacation` boolean, required: Indicates if altering the vacation functionality requires a passcode. This value is always false when the access control is disabled (i.e., when there is no passcode).
      - `other` boolean, required: Indicates whether a passcode is required to change additional settings. These settings include speaker volume, date and time, Wi-Fi, HomeKit, installation settings, passcode settings on the device, and reset options (such as registration reset and schedule/comfort settings reset). This value is always false when access control is disabled (i.e., when no passcode is set).

## Other responses

- `400`: Bad request
- `401`: Not authenticated
- `403`: Not authorized
- `404`: Not found
- `422`: Validation Failed
- `429`: Too many requests
- `500`: Internal server error
- `default`: Unexpected error

---

[API](https://skmtc.dev/ecobee/apis/ecobee-smartbuildings-public-api.md) - [All operations](https://skmtc.dev/ecobee/apis/ecobee-smartbuildings-public-api/llms.txt) - [OpenAPI document](https://skmtc.dev/ecobee/apis/ecobee-smartbuildings-public-api/revisions/d78d4fd5e1c6?raw)