# Update settings (/docs/api-reference/scheduling-settings/update-scheduling-settings)

Changes what's given.

`PATCH https://api.coss.com/v1/scheduling/settings`

Authenticate with your API key as a bearer token (`Authorization: Bearer coss_test_…`). Responses are JSON with snake_case fields; errors are `{ error: { type, code, message, param?, issues?, request_id } }` (https://coss.com/docs/api-reference/errors.md).

## Request body

- `allowed_origins` (string[], at most 10 items)
- `brand_name` (string | null, 1-100 characters)
- `accent_color` (string | null)
- `email_from` (string | null, email, at most 320 characters)
- `sms_from` (string | null)
- `calendar_failure_mode` ("hide" | "last_known")
- `notifications` (map of object | null)

## Example request

TypeScript (the `coss` package):

```ts
import { Coss } from "coss";

const coss = new Coss({
  apiKey: process.env.COSS_API_KEY,
  baseUrl: "https://api.coss.com",
});

const { data, error } = await coss.scheduling.settings.update({
  brand_name: "Acme Health",
});
```

HTTP:

```sh
curl -X PATCH "https://api.coss.com/v1/scheduling/settings" \
  -H "Authorization: Bearer $COSS_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
  "brand_name": "Acme Health"
}'
```

## Response 200

The settings.

- `object` ("scheduling.settings", required)
- `allowed_origins` (string[], required): Sites allowed to embed coss.com's hosted pages and call the client API.
- `brand_name` (string | null, required)
- `accent_color` (string | null, required)
- `email_from` (string | null, required): Sender of booking emails, on a verified domain.
- `sms_from` (string | null, required): Your approved number for SMS reminders. Without one, no SMS is sent.
- `calendar_failure_mode` ("hide" | "last_known", required): When a host's calendar can't be read: stop offering them, or keep offering their last known times and flag those bookings as unverified.
- `notifications` (map of object | null, required): Per event, overriding the defaults.

Example:

```json
{
  "object": "scheduling.settings",
  "allowed_origins": [
    "https://app.example.com"
  ],
  "brand_name": "Acme Health",
  "accent_color": null,
  "email_from": "appointments@example.com",
  "sms_from": null,
  "calendar_failure_mode": "hide",
  "notifications": {
    "reminder": {
      "sms_attendee": true
    }
  }
}
```

## Errors

- `400`: The body is not valid JSON (`invalid_json`). Also when the `Coss-Version` header names an unknown API version (`invalid_api_version`).
- `401`: The API key is missing, invalid, revoked or expired (`authentication_error`).
- `403`: The API key lacks the permission this endpoint needs (`permission_error`), or its organization is suspended (`organization_suspended`).
- `415`: The body is not sent as `application/json` (`unsupported_media_type`).
- `422`: The request failed validation (`validation_error`, see `issues`), or can't be done: see `code`.
- `429`: Too many requests with this API key (`rate_limited`), or too many requests with invalid keys from this address (`too_many_failed_authentications`). Retry after `Retry-After` seconds. Successful responses carry `RateLimit-Limit`, `RateLimit-Remaining` and `RateLimit-Reset` (seconds until the limit is fully restored).
- `500`: Unexpected server error (`api_error` / `internal_error`).
- `503`: The API key could not be verified right now; retry (`service_unavailable`).