---
title: "Update Organization Flags"
method: POST
path: "/admin/organization/{organization_uuid}/update_flags"
tags: ["admin"]
---

# Update Organization Flags

`POST /admin/organization/{organization_uuid}/update_flags`

Toggle org-wide boolean flags. Only fields present in the request body are updated.

Side effect: when enabling ``require_2fa``, revoke refresh tokens for any member who has
a password on file and lacks 2FA, so they're bounced through forced setup once their
current access token expires. SSO-only members (no hashed_password) are untouched — their
only auth path is Google, which handles 2FA at the IdP.

## Path parameters

- `organization_uuid` string, required

## Cookies

- `access_token` string, nullable

## Request body

- OrganizationFlagsUpdate
  - `require_2fa` boolean, nullable
  - `public_sharing_disabled` boolean, nullable
  - `third_party_data_sources_disabled` boolean, nullable

## Response `200`

Successful Response

- unknown

## Other responses

- `422` — Validation Error

---

[API](https://skmtc.dev/rowansci/apis/eyrie.md) · [All operations](https://skmtc.dev/rowansci/apis/eyrie/llms.txt) · [OpenAPI document](https://skmtc-service-production.skmtc.workers.dev/v1/apis/rowansci/eyrie/revisions/f786577eede6/schema)