---
title: "Update settings"
method: PATCH
path: "/api/v1/me/settings"
tags: ["Settings"]
---

# Update settings

`PATCH /api/v1/me/settings`

## Request

- Base URL: `https://api.proof.holdings`
- URL: `https://api.proof.holdings/api/v1/me/settings`
- Auth: API key in cookie `auth_token`

Update user settings: branding, the outbound webhook endpoint and its event subscriptions, and the default proof lifetime. Setting the first endpoint mints the signing secret and returns it in this response; `webhook.rotate_secret` replaces it and returns the new value.

## Request body

- UpdateSettingsRequest: Request body for updating user settings
  - `branding` unknown
  - `webhook` WebhookSettings: Outbound webhook configuration. The signing secret is created with the first endpoint; deliveries carry it as an HMAC-SHA256 `X-Proof-Signature` over `<X-Proof-Timestamp>.<body>`.
    - `url` string, uri, nullable: HTTPS endpoint outbound webhooks are delivered to, at most 2000 characters. `null` removes it. Private, loopback and link-local addresses are refused.
    - `events` string[]: Subscription patterns: an exact event type, a family wildcard such as `proof.*`, or `*` for everything. An empty list means every event.
    - `rotate_secret` boolean: Replace the signing secret and return the new value in this response. The previous value stops verifying immediately.
  - `proof_expiry_days` integer: Default proof-token lifetime in days for newly issued proofs.

## Response `200`

Settings updated. The body carries the stored settings back, including `webhook.secret` when this request created or rotated it — the generic success envelope it used to declare omitted a credential the response can carry.

- UpdateSettingsResponse: Account settings as stored after the update. Carries `webhook.secret` when THIS request created or rotated it — the only response that ever does.
  - `success` boolean, required
  - `webhook` WebhookSettingsResponse, required: Outbound webhook configuration as stored.
    - `url` string, uri, nullable, required
    - `events` string[], required
    - `secret_set` boolean, required: Whether a signing secret exists for this account.
    - `secret` string: The signing secret itself. Returned to a dashboard session, and to any caller in the response that CREATED or ROTATED it — never to an API key merely reading settings.
  - `proof_expiry_days` integer, nullable, required: Default proof-token lifetime in days, or null when the account has never set one.

## Other responses

- `400`: Validation error
- `401`: Unauthorized
- `403`: `account_key_required` — this API key is bound to one sub-account; account-level changes need an account-wide key or the dashboard.

---

[API](https://skmtc.dev/proof/apis/proof-holdings-api.md) · [All operations](https://skmtc.dev/proof/apis/proof-holdings-api/llms.txt) · [OpenAPI document](https://skmtc.dev/proof/apis/proof-holdings-api/revisions/b15f506de696?raw)