# Update the Verify settings (/docs/api-reference/verify-settings/update-verify-settings)

Changes the fields given; the others keep their values. `sms_from` must be one of the organization's numbers, and a live key's `email_from` must be on one of its verified domains.

`PATCH https://api.coss.com/v1/verify/settings`

Authenticate with your API key as a bearer token (`Authorization: Bearer coss_test_…`). Responses are JSON with snake_case fields; errors are `{ error: { type, code, message, param?, issues?, request_id } }` (https://coss.com/docs/api-reference/errors.md).

## Request body

- `app_name` (string | null, 1-40 characters): The name codes are sent for; `null`: the project's.
- `code_length` (integer, 4-10): Digits in a code, 4-10.
- `ttl_seconds` (integer, 60-1800): How long a code works, 60-1800 s.
- `max_attempts` (integer, 1-10): Wrong codes before a verification fails, 1-10.
- `sms_from` (string | null): One of the organization's numbers; `null`: coss.com's shared numbers.
- `email_from` (string | null, email): An address on one of the organization's verified domains (live keys); `null`: coss.com's.
- `allowed_countries` (string[], at most 250 items): ISO 3166 countries SMS codes may go to.

## Example request

TypeScript (the `coss` package):

```ts
import { Coss } from "coss";

const coss = new Coss({
  apiKey: process.env.COSS_API_KEY,
  baseUrl: "https://api.coss.com",
});

const { data, error } = await coss.verify.settings.update({
  sms_from: "+14155550100",
  allowed_countries: [
    "CA",
    "GB",
    "US",
  ],
});
```

HTTP:

```sh
curl -X PATCH "https://api.coss.com/v1/verify/settings" \
  -H "Authorization: Bearer $COSS_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
  "sms_from": "+14155550100",
  "allowed_countries": [
    "CA",
    "GB",
    "US"
  ]
}'
```

## Response 200

The settings.

- `object` ("verify_settings", required)
- `app_name` (string, required): The name codes are sent for.
- `app_name_is_default` (boolean, required): Whether `app_name` is the project's: no name of its own is set.
- `code_length` (integer, required): Digits in a code.
- `ttl_seconds` (integer, required): How long a code works.
- `max_attempts` (integer, required): Wrong codes before a verification fails.
- `sms_from` (string | null, required): One of the organization's numbers; `null`: coss.com's shared numbers.
- `email_from` (string | null, required): An address on one of the organization's verified domains; `null`: coss.com's.
- `allowed_countries` (string[], required): ISO 3166 countries SMS codes may go to.

Example:

```json
{
  "object": "verify_settings",
  "app_name": "Acme",
  "app_name_is_default": false,
  "code_length": 6,
  "ttl_seconds": 600,
  "max_attempts": 5,
  "sms_from": "+14155550100",
  "email_from": "codes@acme.com",
  "allowed_countries": [
    "CA",
    "US"
  ]
}
```

## Errors

- `400`: The `Coss-Version` header names an unknown API version (`invalid_api_version`).
- `401`: The API key is missing, invalid, revoked or expired (`authentication_error`).
- `403`: The API key lacks the permission this endpoint needs (`permission_error`), or its organization is suspended (`organization_suspended`).
- `422`: The body failed validation (`validation_error`), or a sender isn't the organization's (`invalid_settings`).
- `429`: Too many requests with this API key (`rate_limited`), or too many requests with invalid keys from this address (`too_many_failed_authentications`). Retry after `Retry-After` seconds. Successful responses carry `RateLimit-Limit`, `RateLimit-Remaining` and `RateLimit-Reset` (seconds until the limit is fully restored).
- `500`: Unexpected server error (`api_error` / `internal_error`).
- `503`: The API key could not be verified right now; retry (`service_unavailable`).