# Update the Sign settings (/docs/api-reference/sign-settings/update-sign-settings)

Changes the fields given; the others keep their values.

`PATCH https://api.coss.com/v1/sign/settings`

Authenticate with your API key as a bearer token (`Authorization: Bearer coss_test_…`). Responses are JSON with snake_case fields; errors are `{ error: { type, code, message, param?, issues?, request_id } }` (https://coss.com/docs/api-reference/errors.md).

## Request body

- `allowed_origins` (string[], at most 10 items)
- `display_name` (string | null, at most 64 characters)
- `accent_color` (string | null)
- `theme` ("system" | "light" | "dark")
- `disclosure` (string | null, 1-10000 characters)
- `email_from` (string | null, email, at most 254 characters)
- `reminder_interval_days` (integer | null, 1-30)

## Example request

TypeScript (the `coss` package):

```ts
import { Coss } from "coss";

const coss = new Coss({
  apiKey: process.env.COSS_API_KEY,
  baseUrl: "https://api.coss.com",
});

const { data, error } = await coss.sign.settings.update({
  allowed_origins: [
    "https://app.example.com",
  ],
  display_name: "Acme",
});
```

HTTP:

```sh
curl -X PATCH "https://api.coss.com/v1/sign/settings" \
  -H "Authorization: Bearer $COSS_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
  "allowed_origins": [
    "https://app.example.com"
  ],
  "display_name": "Acme"
}'
```

## Response 200

The settings.

- `object` ("sign_settings", required)
- `allowed_origins` (string[], required): Origins that may embed the signing page in an iframe, like `https://app.example.com` (sandbox environments also `http://localhost:<port>`). Empty: it can only be opened on its own.
- `display_name` (string | null, required): The requester's name signers see. `null`: the organization's name.
- `accent_color` (string | null, required)
- `theme` ("system" | "light" | "dark", required)
- `disclosure` (string | null, required): Your own consent text signers accept before they see a document. `null`: coss.com's default, which covers ESIGN's consumer disclosure. Have your counsel review a replacement.
- `email_from` (string | null, required): Signing emails (invitations, reminders, signed copies) come from this address, on a verified domain in live environments. `null`: from coss.com, as "<display name> via coss.com".
- `reminder_interval_days` (integer | null, required): The default days between reminders for new requests; `null`: none.

Example:

```json
{
  "object": "sign_settings",
  "allowed_origins": [
    "https://app.example.com"
  ],
  "display_name": "Acme",
  "accent_color": "#2563eb",
  "theme": "system",
  "disclosure": null,
  "email_from": "contracts@acme.com",
  "reminder_interval_days": 3
}
```

## Errors

- `400`: The `Coss-Version` header names an unknown API version (`invalid_api_version`).
- `401`: The API key is missing, invalid, revoked or expired (`authentication_error`).
- `403`: The API key lacks the permission this endpoint needs (`permission_error`), or its organization is suspended (`organization_suspended`).
- `422`: The body failed validation (`validation_error`), or an origin isn't `https://host[:port]` (`invalid_origin`).
- `429`: Too many requests with this API key (`rate_limited`), or too many requests with invalid keys from this address (`too_many_failed_authentications`). Retry after `Retry-After` seconds. Successful responses carry `RateLimit-Limit`, `RateLimit-Remaining` and `RateLimit-Reset` (seconds until the limit is fully restored).
- `500`: Unexpected server error (`api_error` / `internal_error`).
- `503`: The API key could not be verified right now; retry (`service_unavailable`).