# Update a sub-account (/docs/api-reference/sub-accounts/update-subaccount)

Changes the name, uid, metadata, status or quotas. Fields left out keep their value; `status: "disabled"` refuses its sends until it is `active` again.

`PATCH https://api.coss.com/v1/subaccounts/{subaccount}`

Authenticate with your API key as a bearer token (`Authorization: Bearer coss_test_…`). Responses are JSON with snake_case fields; errors are `{ error: { type, code, message, param?, issues?, request_id } }` (https://coss.com/docs/api-reference/errors.md).

## Path parameters

- `subaccount` (string, required): The sub-account's `id` (`sub_…`) or your `uid` for it.

## Request body

- `name` (string, 1-256 characters)
- `uid` (string | null): `null` removes it.
- `metadata` (map of string): Replaces the metadata.
- `status` ("active" | "disabled"): `disabled` refuses its sends until it is `active` again.
- `quotas` (object): Fields left out keep their value; `null` removes a quota.
  - `recipients_per_day` (integer | null, 1-100000000)
  - `recipients_per_second` (integer | null, 1-100000000)
  - `burst` (integer | null, 1-100000000)

## Example request

TypeScript (the `coss` package):

```ts
import { Coss } from "coss";

const coss = new Coss({
  apiKey: process.env.COSS_API_KEY,
  baseUrl: "https://api.coss.com",
});

const { data, error } = await coss.email.subaccounts.update("user_8812", {
  status: "disabled",
});
```

HTTP:

```sh
curl -X PATCH "https://api.coss.com/v1/subaccounts/user_8812" \
  -H "Authorization: Bearer $COSS_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
  "status": "disabled"
}'
```

Python:

```python
from coss import Coss

client = Coss()  # api_key= or COSS_API_KEY

client.email.subaccounts.update(
    subaccount="user_8812",
    status="disabled",
)
```

Go:

```go
import (
	"context"

	cossclient "github.com/cosscom/coss-go/client"
	email "github.com/cosscom/coss-go/email"
)

client := cossclient.NewClient() // option.WithAPIKey(…) or COSS_API_KEY

request := &email.UpdateSubaccountRequest{
    Subaccount: "user_8812",
    Status: email.UpdateSubaccountRequestStatusDisabled.Ptr(),
}
client.Email.Subaccounts.Update(
    context.TODO(),
    request,
)
```

Ruby:

```ruby
require "coss"

client = Coss::Client.new # api_key: or COSS_API_KEY

client.email.subaccounts.update(
  subaccount: "user_8812",
  status: "disabled"
)
```

PHP:

```php
<?php

use Coss\Coss;
use Coss\Email\Subaccounts\Requests\UpdateSubaccountRequest;
use Coss\Email\Subaccounts\Types\UpdateSubaccountRequestStatus;

$client = new Coss(); // apiKey: or COSS_API_KEY

$client->email->subaccounts->update(
    'user_8812',
    new UpdateSubaccountRequest([
        'status' => UpdateSubaccountRequestStatus::Disabled->value,
    ]),
);
```

Java:

```java
import com.coss.Coss;
import com.coss.resources.email.subaccounts.requests.UpdateSubaccountRequest;
import com.coss.resources.email.subaccounts.types.UpdateSubaccountRequestStatus;

Coss client = Coss.builder().build(); // .apiKey(…) or COSS_API_KEY

client.email().subaccounts().update(
    "user_8812",
    UpdateSubaccountRequest
        .builder()
        .status(UpdateSubaccountRequestStatus.DISABLED)
        .build()
);
```

.NET:

```csharp
using Coss;
using Coss.Email;

var client = new CossClient(); // apiKey: or COSS_API_KEY

await client.Email.Subaccounts.UpdateAsync(
    new UpdateSubaccountRequest
    {
        Subaccount = "user_8812",
        Status = UpdateSubaccountRequestStatus.Disabled,
    }
);
```

## Response 200

The sub-account.

- `object` ("subaccount", required)
- `id` (string, required)
- `uid` (string | null, required): Your own id for it (e.g. your user's id), unique in the environment. Every path and send that takes a sub-account accepts its `id` or its `uid`.
- `name` (string, required)
- `metadata` (map of string, required)
- `status` ("active" | "disabled" | "deleting", required): `disabled`: you turned it off (its sends are refused). `deleting`: its domains are being released.
- `quotas` (object, required)
  - `recipients_per_day` (integer | null, required, 1-100000000): Recipients it may send to per day; `null`: only your organization's quota.
  - `recipients_per_second` (integer | null, required, 1-100000000): Recipients it may send to per second; `null`: only your organization's quota.
  - `burst` (integer | null, required, 1-100000000): How many recipients a moment may take before the per-second rate applies; `null`: the per-second rate.
- `reputation` (object, required)
  - `status` ("good" | "warning" | "paused", required): `warning`: a rate is close to its limit. `paused`: its live sends are refused (`subaccount_paused`) until you reinstate it.
  - `trigger` (string | null, required): What last changed it, e.g. `bounce_rate`, `complaint_rate`, `content_screening`.
  - `changed_at` (string | null, required, date-time)
  - `reinstated_at` (string | null, required, date-time)
- `created_at` (string, required, date-time)
- `updated_at` (string, required, date-time)

Example:

```json
{
  "object": "subaccount",
  "id": "sub_01k7c8m4q2f3e9v6t5r1n0p8yz",
  "uid": "user_8812",
  "name": "Acme Bakery",
  "metadata": {
    "plan": "pro"
  },
  "status": "active",
  "quotas": {
    "recipients_per_day": 5000,
    "recipients_per_second": 5,
    "burst": 50
  },
  "reputation": {
    "status": "good",
    "trigger": null,
    "changed_at": null,
    "reinstated_at": null
  },
  "created_at": "2026-01-15T09:30:00.000Z",
  "updated_at": "2026-01-15T09:30:00.000Z"
}
```

## Errors

- `400`: The body is not valid JSON (`invalid_json`). Also when the `Coss-Version` header names an unknown API version (`invalid_api_version`).
- `401`: The API key is missing, invalid, revoked or expired (`authentication_error`).
- `403`: The API key lacks the permission this endpoint needs (`permission_error`), or its organization is suspended (`organization_suspended`).
- `404`: No sub-account with this id or uid exists in the API key's environment (`subaccount_not_found`).
- `413`: The request body is larger than 5 MB (`payload_too_large`).
- `415`: The body is not sent as `application/json` (`unsupported_media_type`).
- `422`: The body failed validation (`validation_error`), the uid is taken (`uid_taken`), the quotas don't fit together (`invalid_quotas`), or it is being deleted (`subaccount_deleting`).
- `429`: Too many requests with this API key (`rate_limited`), or too many requests with invalid keys from this address (`too_many_failed_authentications`). Retry after `Retry-After` seconds. Successful responses carry `RateLimit-Limit`, `RateLimit-Remaining` and `RateLimit-Reset` (seconds until the limit is fully restored).
- `500`: Unexpected server error (`api_error` / `internal_error`).
- `503`: The API key could not be verified right now; retry (`service_unavailable`).