---
title: "Create or update a company"
method: PUT
path: "/apps/{appId}/envs/{envId}/companies/{companyId}"
---

# Create or update a company

`PUT /apps/{appId}/envs/{envId}/companies/{companyId}`

## Request

- Base URL: `https://app.reflag.com/api`
- URL: `https://app.reflag.com/api/apps/{appId}/envs/{envId}/companies/{companyId}`
- Auth: HTTP bearer

Synchronously create or update a company in an environment. Requires the `write:entities` API key scope or admin member access. This scope also grants deletion through the corresponding entity DELETE endpoints, but does not grant membership changes or flag targeting; grant `write:flag:targeting` separately to assign flags and `read` for GET requests. Attributes accept JSON values and are normalized and merged using the same rules as ingestion. Recognized name and avatar attributes also update the corresponding company fields; top-level `name` takes precedence over name attributes. Omitting a field preserves its existing value. New companies may omit all fields. When this request succeeds, a subsequent company targeting request can read the company. Flag configuration propagation to SDKs is independent. Delayed ingestion writes may later replace overlapping values because the last database writer wins.

## Path parameters

- `appId` string, required: App identifier
- `envId` string, required: Environment identifier
- `companyId` string, required: Company ID within your application

## Request body

- object
  - `name` string: Company name. Omit it to preserve an existing name; new companies may be unnamed.
  - `attributes` EntityAttributesInput, nullable: Entity attributes. Values are normalized exactly like ingestion before being merged with existing attributes.

## Response `200`

Company created or updated successfully

- object
  - `name` string: Company name. Omit it to preserve an existing name; new companies may be unnamed.
  - `attributes` EntityAttributesInputOutput, nullable: Entity attributes. Values are normalized exactly like ingestion before being merged with existing attributes.
  - `id` string, required: Company ID within your application

## Other responses

- `400`: Bad Request
- `401`: Unauthorized
- `403`: Forbidden
- `404`: Requested resource, or its parent, not found

## Changes

- **2026-09-11** `168d14804058`: 1 info
  - endpoint added

[Operation history](https://skmtc.dev/reflag/apis/reflag-management-api/changes/apps/:appId/envs/:envId/companies/:companyId/put.md)

---

[API](https://skmtc.dev/reflag/apis/reflag-management-api.md) - [All operations](https://skmtc.dev/reflag/apis/reflag-management-api/llms.txt) - [OpenAPI document](https://skmtc.dev/reflag/apis/reflag-management-api/revisions/280aaed4e96e?raw)