Update organization

false refuses Elaichi support access to this organization: every request made through a support session is refused, reads included. Recorded in the organization.updated audit entry: the field is named in fields and the value it was set to is in the entry's allow_staff_impersonation metadata.

true requires every member to hold a second factor to act in this organization; false lifts it. See the operation description for who may change it and what a change needs.

Organization id (org_…) — the value for X-Organization-Id.

Immutable after creation.

The stored plan: gold, black, or none when locked. This is not the same as the effective entitlement — read GET /organization/{id}/entitlements before gating a feature on it.

Data location fixed at creation: us/eu pin a hard jurisdiction, apac is a placement hint.

Set when Elaichi granted this organization an indefinite trial, otherwise null. Unlocked with no end date: no countdown, no expiry email, billing still reachable.

Public URL of the logo image, or null.

Whether the caller may delete this organization: the org:delete permission, which only the Org Owner role holds. Server-computed, so branch on this rather than inspecting roles. Always false on rows that have no member context to compute it from, such as the organization list GET /organization. It never overstates: trust it when true, and read GET /user/me or GET /organization/{id} (both compute it) when you need it for a list row.

Whether the caller may change this organization's settings: the org:manage permission that PATCH /organization/{id} requires, and the organization is neither suspended nor in its deletion grace period. Server-computed, and false wherever can_delete is false for lack of a member context; it never overstates.

Whether Elaichi support may sign in as this organization's members to help them. true by default. When false, every request made through such a support session against this organization is refused with 403 staff_impersonation_blocked, reads included, and the organization is left out of that session's GET /user/me and GET /organization. Changed with PATCH /organization/{id} (org:manage).

Whether members must hold a second factor to act in this organization. false by default. When true, a signed-in session that has not shown a second factor (no TOTP challenge at login, no passkey sign-in, no factor enrolled since) is refused on every organization-scoped route, reads included, with 403 mfa_setup_required; error.details.has_second_factor says whether the person already has one and only needs to sign in with it. Exempt: org API tokens, Elaichi support sessions, and a session signed in through this organization's own SSO connection. MCP connections made before it was switched on, or from a session without a factor, are refused until the person connects again. Turning it off only lifts the organization requirement: a member who set up an authenticator app of their own is still challenged for it at every non-passkey sign-in. Changed with PATCH /organization/{id} (org:manage, interactive session only).

Whether the CALLER may turn mfa_required ON right now: can_manage, from an interactive session that would itself pass the check it is about to create. false — with the reason in can_require_mfa_reason — when switching it on would lock the caller out of this organization. The PATCH refuses that regardless with 409 mfa_setup_required. Turning it OFF is not governed by this field; it needs a step-up.

A sentence saying why can_require_mfa is false for a caller who can otherwise manage the organization. null otherwise.

Set when a deletion has been scheduled (DELETE /organization/{id}). The organization is read-only until purge_after. Null otherwise.

When a scheduled deletion becomes permanent — 30 days after deletion_scheduled_at. Null unless scheduled.

Whether the caller may cancel a scheduled deletion: the org:manage permission, and only while purge_after is still ahead. Server-computed like can_delete, and false on rows with no member context. Read purge_after to tell "too late" from "not yours to undo".

Whether the CALLER may connect an app (MCP OAuth consent) to this organization right now: false while it is suspended, scheduled for deletion, or has no active plan. Server-computed by the same gate POST /oauth/authorize-request/{id}/approve calls; present only on member-scoped responses. authorize_apps_blocked_reason says which.

Why can_authorize_apps is false, in the gate's own order: blocked, then pending_deletion (even when the subscription is also gone, since a soft delete cancels it), then no_plan. null when connecting is open.