---
title: "Update hosted Code Audit provider retention"
method: PATCH
path: "/v1/organizations/{organizationId}/data-controls"
tags: ["Account"]
---

# Update hosted Code Audit provider retention

`PATCH /v1/organizations/{organizationId}/data-controls`

## Request

- Base URL: `https://api.inth.com`
- URL: `https://api.inth.com/v1/organizations/{organizationId}/data-controls`
- Auth: HTTP bearer

Requires organization-retention.write and owner. expectedVersion prevents stale changes; mutationId supports retries. Retains enterprise, configuration, strict-ZDR rollout and active-run checks. Requires a user-delegated OAuth token. Organization API keys are refused. Enforced after scope and role authorization: rollout-agent-access-writes (default off) and allow-public-agent-writes (default on). Reads remain available when writes are paused.

## Path parameters

- `organizationId` string, required

## Request body

- OrganizationRetentionUpdate
  - `mutationId` string, required
  - `expectedVersion` integer, required
  - `providerRetention` 'standard' | 'strict-zdr', required

## Response `200`

Update hosted Code Audit provider retention

- object
  - `success` true, required
  - `data` OrganizationRetention, required
    - `organizationId` string, required
    - `version` integer, required
    - `scope` 'hosted-code-audit', required
    - `savedProviderRetention` 'standard' | 'strict-zdr', required
    - `effectiveProviderRetention` 'standard' | 'strict-zdr', required
    - `canEnableStrictZdr` boolean, required
    - `canDisableStrictZdr` boolean, required
    - `strictZdrUnavailableReason` 'not-owner' | 'entitlement-missing' | 'entitlement-unavailable' | 'rollout-disabled' | 'not-configured', nullable, required

## Other responses

- `400`: The request payload or parameters are invalid.
- `401`: Authentication is missing, invalid, or expired.
- `403`: The credential is valid but may not perform the operation. `INSUFFICIENT_SCOPE`: the credential was never granted the capability the operation needs. `details.requiredScope` names it, and the `WWW-Authenticate` header carries `Bearer error="insufficient_scope"`. An OAuth client fixes this by requesting the scope; an organization API key cannot gain it. `FORBIDDEN`: the capability is present but the membership behind the credential lacks the role, or the resource belongs to another organization.
- `404`: The requested resource was not found.
- `409`: The request conflicts with the current resource state.
- `503`: The capability is temporarily paused by an operator. Retry later.

## Changes

- **2026-10-31** `a3f4100e14c9`: 1 info
  - endpoint added

[Operation history](https://skmtc.dev/inth/apis/inth-api/changes/v1/organizations/:organizationId/data-controls/patch.md)

---

[API](https://skmtc.dev/inth/apis/inth-api.md) - [All operations](https://skmtc.dev/inth/apis/inth-api/llms.txt) - [OpenAPI document](https://skmtc.dev/inth/apis/inth-api/revisions/5a1be8d43402?raw)