---
title: "Update flag targeting for a company"
method: PATCH
path: "/apps/{appId}/envs/{envId}/companies/{companyId}/flags"
---

# Update flag targeting for a company

`PATCH /apps/{appId}/envs/{envId}/companies/{companyId}/flags`

## Request

- Base URL: `https://app.reflag.com/api`
- URL: `https://app.reflag.com/api/apps/{appId}/envs/{envId}/companies/{companyId}/flags`
- Auth: HTTP bearer

Update specific targeting for flags for a company in an environment. Returns the environment flag-state version containing the completed update.

## Path parameters

- `appId` string, required: App identifier
- `envId` string, required: Environment identifier
- `companyId` string, required: Company ID within your application

## Request body

- UpdateEntityFlagsBody: Request body for updating flags for an entity
  - `updates` EntityFlagUpdate[], required: List of flag updates to apply
    - `flagKey` string, required: Unique flag key
    - `specificTargetValue` true, nullable, required: Set to true to add a specific-targeting override, or null to remove it
  - `changeDescription` string: Description of the change for audit history
  - `notifications` string[]: Destination list for notifications about the change. Use [] to disable notifications. Omit to use configured defaults.

## Response `200`

Requested resource retrieved successfully

- UpdateEntityFlagsResponse: Updated entity flags and the environment flag-state version containing the change
  - `data` EntityFlag[], required: List of flags with their enabled status
    - `id` string, required: Flag ID
    - `key` string, required: Unique flag key
    - `name` string, required: Flag name
    - `createdAt` string, required: Timestamp when the flag was created
    - `value` boolean, required: Evaluated enabled state using current runtime rules and stored entity attributes, not the last SDK result or a default value. Company checks supply only company context. User checks supply user context and also check each stored company membership; no other/request context is supplied. Stored attributes and context may differ from a live SDK request.
    - `specificTargetValue` boolean, nullable, required: Saved explicit assignment, or null if absent. May be true while value is false when targeting is No one. This is configuration metadata, not an effective-access override.
    - `firstExposureAt` string, nullable, required: First time the entity was exposed to this flag
    - `lastExposureAt` string, nullable, required: Last time the entity was exposed to this flag
    - `lastCheckAt` string, nullable, required: Last time the flag was checked for this entity
    - `exposureCount` integer, required: Number of times the entity was exposed to this flag
    - `firstTrackAt` string, nullable, required: First time a track event was recorded for this flag
    - `lastTrackAt` string, nullable, required: Last time a track event was recorded for this flag
    - `trackCount` integer, required: Number of track events for this flag
  - `totalCount` integer, required: Total number of flags
  - `pageSize` integer, required: Page size
  - `pageIndex` integer, required: Page index
  - `flagStateVersion` integer, required: Environment flag-state version containing the completed mutation

## Other responses

- `400`: Bad Request
- `401`: Unauthorized
- `403`: Forbidden
- `404`: Requested resource, or its parent, not found

## Changes

- **2026-11-06** `280aaed4e96e`: 6 breaking, 6 info
  - the response property `data/items/firstExposureAt` became nullable for the status `200`
  - the response property `data/items/firstTrackAt` became nullable for the status `200`
  - the response property `data/items/lastCheckAt` became nullable for the status `200`
  - the response property `data/items/lastExposureAt` became nullable for the status `200`
  - …8 more
- **2026-09-11** `168d14804058`: 1 warning, 1 info
  - for the `path` request parameter `companyId`, the maxLength was set to `128`
  - added the required property `flagStateVersion` to the response with the `200` status

[Operation history](https://skmtc.dev/reflag/apis/reflag-management-api/changes/apps/:appId/envs/:envId/companies/:companyId/flags/patch.md)

---

[API](https://skmtc.dev/reflag/apis/reflag-management-api.md) - [All operations](https://skmtc.dev/reflag/apis/reflag-management-api/llms.txt) - [OpenAPI document](https://skmtc.dev/reflag/apis/reflag-management-api/revisions/280aaed4e96e?raw)