---
title: "Update a Team"
method: PATCH
path: "/v2/teams/{teamId}"
tags: ["teams"]
---

# Update a Team

`PATCH /v2/teams/{teamId}`

## Request

- Base URL: `https://api.vercel.com`
- URL: `https://api.vercel.com/v2/teams/{teamId}`
- Auth: HTTP bearer

Update the information of a Team specified by the `teamId` parameter. The request body should contain the information that will be updated on the Team.

## Path parameters

- `teamId` string, required

## Query parameters

- `slug` string

## Request body

- object
  - `avatar` string, nullable: The hash value of an uploaded image, or `null` to clear the avatar.
  - `description` string: A short text that describes the team.
  - `emailDomain` string, regex, nullable
  - `name` string: The name of the team.
  - `previewDeploymentSuffix` string, hostname, nullable: Suffix that will be used for all preview deployments.
  - `regenerateInviteCode` boolean: Create a new invite code and replace the current one.
  - `saml` object
    - `enforced` boolean: Require that members of the team use SAML Single Sign-On.
    - `roles` object: Directory groups to role or access group mappings.
  - `slug` string: A new slug for the team.
  - `enablePreviewFeedback` string: Enable preview toolbar: one of on, off or default.
  - `enableProductionFeedback` string: Enable production toolbar: one of on, off or default.
  - `sensitiveEnvironmentVariablePolicy` string: Sensitive environment variable policy: one of on, off or default.
  - `disjunctiveProductionSecretPolicy` string: Require production secrets to be in their own environment group: one of on, off or default.
  - `remoteCaching` object: Whether or not remote caching is enabled for the team
    - `enabled` boolean: Enable or disable remote caching for the team.
  - `hideIpAddresses` boolean: Display or hide IP addresses in Monitoring queries.
  - `hideIpAddressesInLogDrains` boolean: Display or hide IP addresses in Log Drains.
  - `dpAccessRequestsMode` 'all' | 'none' | 'email-domain': Controls who can request access to protected deployments.
  - `requireVerifiedCommits` boolean: When enabled, all projects in the team require commits to be signed and verified by the git provider before deployments will be created.
  - `disableRepositoryDispatchEvents` boolean: Default for projects in the team. When `true`, projects in this team will not emit GitHub repository-dispatch events on deployment events unless the project explicitly overrides this setting.
  - `defaultDeploymentProtection` object: Default deployment protection settings for new projects.
    - `passwordProtection` object, nullable: Allows to protect project deployments with a password
      - `deploymentType` 'all' | 'preview' | 'prod_deployment_urls_and_all_previews' | 'all_except_custom_domains', required: Specify if the password will apply to every Deployment Target or just Preview
      - `password` string, nullable: The password that will be used to protect Project Deployments
    - `ssoProtection` object, nullable: Ensures visitors to your Preview Deployments are logged into Vercel and have a minimum of Viewer access on your team
      - `deploymentType` 'all' | 'preview' | 'prod_deployment_urls_and_all_previews' | 'all_except_custom_domains', required: Specify if the Vercel Authentication (SSO Protection) will apply to every Deployment Target or just Preview
  - `defaultPassport` object, nullable: Default Passport configuration for new projects.
    - `connectorId` string, required
    - `deploymentType` 'all' | 'preview' | 'prod_deployment_urls_and_all_previews' | 'all_except_custom_domains'
  - `defaultExpirationSettings` object
    - `expiration` '3y' | '2y' | '1y' | '6m' | '3m' | '2m' | '1m' | '2w' | '1w' | '1d' | 'unlimited': The time period to keep non-production deployments for
    - `expirationProduction` '3y' | '2y' | '1y' | '6m' | '3m' | '2m' | '1m' | '2w' | '1w' | '1d' | 'unlimited': The time period to keep production deployments for
    - `expirationCanceled` '1y' | '6m' | '3m' | '2m' | '1m' | '2w' | '1w' | '1d' | 'unlimited': The time period to keep canceled deployments for
    - `expirationErrored` '1y' | '6m' | '3m' | '2m' | '1m' | '2w' | '1w' | '1d' | 'unlimited': The time period to keep errored deployments for
    - `keepCurrentRetention` boolean: When true, opts a Pro team out of the upcoming deployment-storage retention reduce. Does not change expiration settings. Unmetered teams also require acknowledgeStorageBilling.
    - `acknowledgeStorageBilling` boolean: Required with keepCurrentRetention for unmetered Pro teams; acknowledges that keeping current retention will incur storage billing on a later date.
  - `deploymentPolicy` union
    - object: Composable deployment-time policy. Each rule type holds a list of rules, one per environment scope.
      - `gitSources` union
        - object[]
          - `enabled` boolean, required
          - `environments` union[], required
            - union
              - …
          - `sources` union[], required
            - union
              - …
        - string
      - `deploymentSources` union
        - object[]
          - `enabled` boolean, required
          - `environments` union[], required
            - union
              - …
          - `sources` string[], required
        - string
    - string
  - `strictDeploymentProtectionSettings` object: When enabled, deployment protection settings require stricter permissions (owner-only).
    - `enabled` boolean, required: Enable or disable strict deployment protection settings.
  - `strictShareableLinks` object: When enabled, creating shareable links requires Owner role.
    - `enabled` boolean, required: Enable or disable requiring Owner role to create shareable links.
  - `strictPasswordProtectionSettings` object: When enabled, adding, changing, or removing project password protection requires Owner role.
    - `enabled` boolean, required: Enable or disable requiring Owner role to change project password protection.
  - `strictConnectors` object: When enabled, creating and managing connectors requires Owner role.
    - `enabled` boolean, required: Enable or disable requiring Owner role to manage connectors.
  - `nsnbConfig` union
    - object: NSNB configuration for the team.
      - `preference` 'auto-approval' | 'manual-approval' | 'block', required: The NSNB preference for the team.
    - string
  - `defaultProjectJobs` union
    - object: Default job configuration applied to new projects created in this team.
      - `lint` object
        - `targets` string[], required
      - `typecheck` object
        - `targets` string[], required
    - string
  - `resourceConfig` object: Resource configuration for the team.
    - `buildMachine` object: Build machine configuration.
      - `default` 'basic' | 'enhanced' | 'turbo' | 'standard' | 'elastic': Default build machine type for new builds: standard, enhanced, turbo, or elastic.

## Response `200`

- Team: Data representing a Team.
  - `apiKeysInvalidatedAt` number: Timestamp (ms) after which API keys created at or before this time are considered invalid for this team.
  - `appTokensInvalidatedAt` number: Timestamp (ms) after which Vercel App tokens created at or before this time are considered invalid for this team.
  - `avatar` string, nullable, required: The ID of the file used as avatar for this Team.
  - `billing` object, nullable, required: The team's billing plan.
    - `plan` 'enterprise' | 'hobby' | 'pro', required
  - `connect` object
    - `enabled` false | true
  - `createdAt` number, required: UNIX timestamp (in milliseconds) when the Team was created.
  - `creatorId` string, required: The ID of the user who created the Team.
  - `defaultContinuousUsageKind` 'metered' | 'unmetered': Default continuous-usage billing kind for projects under this team. Absent means projects stay unmetered.
  - `defaultDeploymentProtection` object, required: Deployment protection defaults for new projects in this team. When no Vercel Authentication default is saved, `ssoProtection` shows Standard Protection. An explicitly saved `null` remains disabled. Organization policy may override the team default during project creation.
    - `passwordProtection` object, nullable
      - `deploymentType` string, required
    - `ssoProtection` object, nullable
      - `deploymentType` string, required
  - `defaultExpirationSettings` object: Default deployment expiration settings for this team
    - `deploymentsToKeep` number: Minimum number of production deployments to keep for this project, even if they are over the production expiration limit.
    - `expirationDays` number: Number of days to keep non-production deployments (mostly preview deployments) before soft deletion.
    - `expirationDaysCanceled` number: Number of days to keep canceled deployments before soft deletion.
    - `expirationDaysErrored` number: Number of days to keep errored deployments before soft deletion.
    - `expirationDaysProduction` number: Number of days to keep production deployments before soft deletion.
  - `defaultPassport` object, nullable: Default Passport configuration for new projects in this team.
    - `connectorId` string, required: Default Passport configuration for new projects in this team.
    - `deploymentType` 'all' | 'all_except_custom_domains' | 'preview' | 'prod_deployment_urls_and_all_previews', required: Default Passport configuration for new projects in this team.
  - `defaultProjectJobs` object: Default job configuration applied to new projects created in this team.
    - `flag-definitions-present` object: Default job configuration applied to new projects created in this team.
      - `targets` string[], required: Default job configuration applied to new projects created in this team.
    - `health-check` object: Default job configuration applied to new projects created in this team.
      - `targets` string[], required: Default job configuration applied to new projects created in this team.
    - `lint` object: Default job configuration applied to new projects created in this team.
      - `targets` string[], required: Default job configuration applied to new projects created in this team.
    - `mfe-config-present` object: Default job configuration applied to new projects created in this team.
      - `targets` string[], required: Default job configuration applied to new projects created in this team.
    - `typecheck` object: Default job configuration applied to new projects created in this team.
      - `targets` string[], required: Default job configuration applied to new projects created in this team.
  - `defaultRoles` object: Default roles for the team.
    - `teamPermissions` string[]
    - `teamRoles` string[]
  - `deploymentPolicy` object: Composable deployment-time policy for the team. Used as the default for every project on the team, with optional per-project overrides on `project.deploymentPolicy`.
    - `deploymentSources` object[]
      - `enabled` false | true, required
      - `environments` union[], required
        - union
          - object
            - `target` 'preview' | 'production', required
            - `type` 'system', required
          - object
            - `environmentId` string, required
            - `type` 'custom', required
      - `sources` string[], required
    - `gitSources` object[]
      - `enabled` false | true, required
      - `environments` union[], required
        - union
          - object
            - `target` 'preview' | 'production', required
            - `type` 'system', required
          - object
            - `environmentId` string, required
            - `type` 'custom', required
      - `sources` union[], required
        - union
          - object: Allowlist entry for GitHub and Bitbucket, whose repos are identified by a flat `org`/`repo` (Bitbucket's workspace/owner maps to `org`, its repo slug to `repo`). Omit `repo` to match any repo in the org. Org is matched case-insensitively.
            - `org` string, required
            - `provider` 'bitbucket' | 'github', required
            - `repo` string
          - object: Allowlist entry for GitLab, which uses nested groups rather than a flat org/repo. `namespace` is the full group path (e.g. `group` or `group/subgroup`); `project` is the leaf project name. Omit `project` to match any project under the namespace. Namespace is matched case-insensitively.
            - `namespace` string, required
            - `project` string
            - `provider` 'gitlab', required
  - `deploymentStorageRollout` object: Pro deployment-storage pricing rollout cohort and milestones. Absent when the team has not been placed in a rollout cohort yet.
    - `cohort` 'already_metered' | 'extreme' | 'high' | 'low' | 'medium' | 'medium_plus' | 'metered_opt_in', required
    - `meteredAt` number: When team-wide metering was recorded for this rollout.
    - `meterReason` 'low_scheduled' | 'medium_scheduled' | 'retention_opt_out'
    - `retentionAppliedAt` number: When the calendar retention-reduce migration applied 30d retention.
    - `retentionOptOutAt` number: When the customer chose "keep my retention" before reduce day.
  - `description` string, nullable, required: A short description of the Team.
  - `disableHardAutoBlocks` union
    - number
    - false | true
  - `disableRepositoryDispatchEvents` false | true: Default for projects in the team. When `true`, projects in this team will not emit GitHub repository-dispatch events on deployment events unless the project explicitly overrides this setting via `project.gitProviderOptions.disableRepositoryDispatchEvents`.
  - `disjunctiveProductionSecretPolicy` 'default' | 'off' | 'on' | 'null', nullable: Require production secrets to use a different value than preview or development.
  - `dpAccessRequestsMode` 'all' | 'email-domain' | 'none': Controls who can request access to protected deployments.
  - `emailDomain` string, nullable: Hostname that'll be matched with emails on sign-up to automatically join the Team.
  - `enablePreviewFeedback` 'default' | 'default-force' | 'off' | 'off-force' | 'on' | 'on-force' | 'null', nullable: Whether toolbar is enabled on preview deployments
  - `enableProductionFeedback` 'default' | 'default-force' | 'off' | 'off-force' | 'on' | 'on-force' | 'null', nullable: Whether toolbar is enabled on production deployments
  - `hideIpAddresses` false | true | null, nullable: Indicates if IP addresses should be accessible in observability (o11y) tooling
  - `hideIpAddressesInLogDrains` false | true | null, nullable: Indicates if IP addresses should be accessible in log drains
  - `id` string, required: The Team's unique identifier.
  - `integrationTokensInvalidatedAt` number: Timestamp (ms) after which integration tokens created at or before this time are considered invalid for this team.
  - `inviteCode` string: Code that can be used to join this Team. Only visible to Team owners.
  - `ipBuckets` object[]
    - `bucket` string, required
    - `default` false | true
    - `supportUntil` number
  - `limited` false, required: Property indicating that this Team data contains full information. Limited Team data has `limited: true`.
  - `membership` object: The membership of the authenticated User in relation to the Team.
    - `accessRequestedAt` number
    - `confirmed` true, required
    - `created` number, required
    - `createdAt` number, required
    - `entitlements` object[]
      - `entitlement` string, required
    - `isOrgBackingTeamMembership` false | true
    - `joinedFrom` object
      - `commitId` string
      - `dsyncConnectedAt` number
      - `dsyncUserId` string
      - `gitUserId` union
        - string
        - number
      - `gitUserLogin` string
      - `idpUserId` string
      - `origin` 'account-update' | 'bitbucket' | 'dsync' | 'feedback' | 'github' | 'gitlab' | 'import' | 'link' | 'mail' | 'nsnb-auto-approve' | 'nsnb-hobby-upgrade' | 'nsnb-invite' | 'nsnb-redeploy' | 'nsnb-redeploy-attribution-card' | 'nsnb-request-access' | 'nsnb-viewer-upgrade' | 'org-admin-sync' | 'organization-teams' | 'saml' | 'teams', required
      - `repoId` string
      - `repoPath` string
      - `ssoConnectedAt` number
      - `ssoUserId` string
    - `organizationId` string
    - `role` 'BILLING' | 'CONTRIBUTOR' | 'DEVELOPER' | 'MEMBER' | 'OWNER' | 'SECURITY' | 'VIEWER' | 'VIEWER_FOR_PLUS', required
    - `teamId` string
    - `teamPermissions` string[]
    - `teamRoles` string[]
    - `uid` string
  - `name` string, nullable, required: Name associated with the Team account, or `null` if none has been provided.
  - `nsnbConfig` object: NSNB configuration for the team.
    - `preference` 'auto-approval' | 'block' | 'manual-approval', required
  - `orgRootTeamId` string: Best-effort ID of the organization’s root billing team. When present, compare `orgRootTeamId === id` to identify the root team. It may be omitted even when `parentId` is set if organization resolution fails or the referenced organization is missing. Always omitted for non-organization teams.
  - `parentId` string: The organizationId for teams that belong to an organization (set on both the organization's root team and its child teams).
  - `personalAccessTokensInvalidatedAt` number: Timestamp (ms) after which personal access tokens created at or before this time are considered invalid for this team.
  - `platform` false | true: Whether the team is a platform team.
  - `previewDeploymentSuffix` string, nullable: The hostname that is current set as preview deployment suffix.
  - `remoteCaching` object: Is remote caching enabled for this team
    - `enabled` false | true
  - `requireVerifiedCommits` false | true: When enabled, all projects in the team require commits to be signed and verified by the git provider before deployments will be created. Projects may override this via `project.gitProviderOptions.requireVerifiedCommits` (gated by `Project:Update`).
  - `resourceConfig` object
    - `blobStores` number: The maximum number of blob stores an account can create.
    - `buildEntitlements` object
      - `enhancedBuilds` false | true
    - `buildMachine` object: Build machine configuration
      - `default` 'basic' | 'elastic' | 'enhanced' | 'standard' | 'turbo': Default build machine type for new builds
    - `concurrentBuilds` number: The total amount of concurrent builds that can be used.
    - `customEnvironmentsPerProject` number: The maximum number of custom environments allowed per project.
    - `edgeConfigs` number: The maximum number of edge configs an account can create.
    - `edgeConfigSize` number: The maximum size in kilobytes of a Global Config. Only specified if a custom limit is set.
    - `elasticConcurrencyEnabled` false | true: Whether every build for this team / user has elastic concurrency enabled automatically.
    - `kvDatabases` number: The maximum number of kv databases an account can create.
    - `postgresDatabases` number: The maximum number of postgres databases an account can create.
    - `serverlessFunctionMaxMemorySize` number: The maximum memory size (in MB) for a serverless function. Only specified if a custom limit is set.
  - `saml` object: When "Single Sign-On (SAML)" is configured, this object contains information regarding the configuration of the Identity Provider (IdP).
    - `connection` object: Information for the SAML Single Sign-On configuration.
      - `connectedAt` number, required: Timestamp (in milliseconds) of when the configuration was connected.
      - `lastReceivedWebhookEvent` number: Timestamp (in milliseconds) of when the last webhook event was received from WorkOS.
      - `lastSyncedAt` number: Timestamp (in milliseconds) of when the last directory sync was performed.
      - `state` string, required: Current state of the connection.
      - `syncState` 'ACTIVE' | 'SETUP': Controls whether directory sync events are processed. - 'SETUP': Directory connected but role mappings not yet configured. Events are acknowledged but not processed. - 'ACTIVE': Fully configured. Events are processed normally. - undefined: Legacy directory (pre-feature), treat as 'ACTIVE' for backwards compatibility.
      - `type` string, required: The Identity Provider "type", for example Okta.
      - `status` string, required
    - `defaultRedirectUri` 'v0.app' | 'v0.dev' | 'vercel.com': The default redirect URI to use after successful SAML authentication.
    - `directory` object: Information for the Directory Sync configuration.
      - `connectedAt` number, required: Timestamp (in milliseconds) of when the configuration was connected.
      - `lastReceivedWebhookEvent` number: Timestamp (in milliseconds) of when the last webhook event was received from WorkOS.
      - `lastSyncedAt` number: Timestamp (in milliseconds) of when the last directory sync was performed.
      - `state` string, required: Current state of the connection.
      - `syncState` 'ACTIVE' | 'SETUP': Controls whether directory sync events are processed. - 'SETUP': Directory connected but role mappings not yet configured. Events are acknowledged but not processed. - 'ACTIVE': Fully configured. Events are processed normally. - undefined: Legacy directory (pre-feature), treat as 'ACTIVE' for backwards compatibility.
      - `type` string, required: The Identity Provider "type", for example Okta.
    - `enforced` false | true, required: When `true`, interactions with the Team **must** be done with an authentication token that has been authenticated with the Team's SAML Single Sign-On provider.
    - `roles` object: When "Directory Sync" is configured, this object contains a mapping of which Directory Group (by ID) should be assigned to which Vercel Team roles and permissions, or an access group. Bare team roles are deprecated in favor of DirectorySyncRolesMapping.
  - `sensitiveEnvironmentVariablePolicy` 'default' | 'off' | 'on' | 'null', nullable: Sensitive environment variable policy for this team
  - `slug` string, required: The Team's slug, which is unique across the Vercel platform.
  - `stagingPrefix` string, required: The prefix that is prepended to automatic aliases.
  - `strictConnectors` object: When enabled, creating and managing connectors requires Owner role or the ConnectorManager permission.
    - `enabled` false | true, required
    - `updatedAt` number, required
  - `strictDeploymentProtectionSettings` object: When enabled, deployment protection settings require stricter permissions (owner-only).
    - `enabled` false | true, required
    - `updatedAt` number, required
  - `strictPasswordProtectionSettings` object: When enabled, adding, changing, or removing project password protection requires Owner role.
    - `enabled` false | true, required
    - `updatedAt` number, required
  - `strictShareableLinks` object: When enabled, creating shareable links requires Owner role.
    - `enabled` false | true, required
    - `updatedAt` number, required
  - `updatedAt` number, required: Timestamp (in milliseconds) of when the Team was last updated.

## Other responses

- `400`: One of the provided values in the request body is invalid.
- `401`: The request is not authorized.
- `402`
- `403`: You do not have permission to access this resource. Not authorized to update the team. Must be an OWNER.
- `404`
- `409`
- `410`
- `428`
- `502`
- `503`

## Changes

- **2026-11-02** `67be12f2c6e5`: 1 info
  - added the optional property `defaultProjectJobs/health-check` to the response with the `200` status
- **2026-10-28** `ddb2b6193ceb`: 1 warning
  - added the new `org-admin-sync` enum value to the `membership/joinedFrom/origin` response property for the response status `200`
- **2026-10-22** `2c530c81d9e1`: 2 info
  - added the non-success response with the status `502`
  - added the non-success response with the status `503`
- **2026-10-19** `b4c010d0e737`: 1 info
  - the response property `defaultDeploymentProtection` became required for the status `200`
- **2026-10-14** `c22a581210d1`: 1 info
  - added the optional property `membership/isOrgBackingTeamMembership` to the response with the `200` status

[Operation history](https://skmtc.dev/vercel/apis/vercel-api/changes/v2/teams/:teamId/patch.md)

---

[API](https://skmtc.dev/vercel/apis/vercel-api.md) - [All operations](https://skmtc.dev/vercel/apis/vercel-api/llms.txt) - [OpenAPI document](https://skmtc.dev/vercel/apis/vercel-api/revisions/60686c0e1f6a?raw)