# PATCH /v1/org

> Change the name, allowed return URLs, allowed embed origins, default deployment or default memory mode.

In [Account API](https://vestra.ai/developers/reference/api/account.md): Your company's account: who is calling, its keys, its caps, what it spent and the models it may use.

Send `Authorization: Bearer vk_test_...` on every call.

Change the name, allowed return URLs, allowed embed origins, default deployment or default memory mode.

Your API key, scope `admin` or `all`. On the card: [`keys`](https://vestra.ai/developers/keys.md). Every call here is a checked sample.

## Request

Body:

- `name` (`string`): The company's name, 1 to 200 characters. Limits: 1 to 200 characters.
- `allowed_return_urls` (`(string (URL))[]`): Where a connect link may send a person back to; replaces the whole list. At most 20. Limits: at most 20 items. Example: `["https://app.example.com/connected"]`.
- `allowed_embed_origins` (`(string (URL))[]`): The https origins whose pages may show Bash in an iframe; replaces the whole list. At most 20. Limits: at most 20 items. Example: `["https://app.example.com"]`.
- `default_deployment` (`string | null`): The deployment a conversation runs when it names none, by name or `dep_` id; null clears it. Limits: at least 1 character.
- `require_user` (`boolean`): True: every request must name a `user_id`, and none reaches the company's own Bash.
- `memory_panel` (`boolean`): True: a session may show the user what Bash remembers.
- `memory_mode` (`"vestra" | "customer" | "none"`): Who keeps what Bash remembers: `vestra`, `customer` (send `memory_endpoint` too) or `none`.
- `memory_endpoint` (`string (URL) | null`): With `memory_mode: customer`, the https URL Bash asks for what to remember; null clears it.
- `otlp_endpoint` (`string (URL) | null`): Where to send traces, as OpenTelemetry over HTTP; null stops them.
- `otlp_headers_secret` (`string | null`): The name of one of your secrets (PUT /v1/secrets/{name}) whose value is a JSON object of header names to values, sent with each trace; null clears it. Example: `OTLP_HEADERS`.

## Answers 200

- `id` (`string`): The company account's id. Example: `org_2f8k`.
- `object` (`"org"`): Always `org`.
- `name` (`string`): The company's name.
- `status` (`string`): `active` while the account works. Any other value means it is switched off, and calls answer 403 `org_disabled`.
- `mode` (`"live" | "test"`): The mode these settings and this wallet belong to: `live` or `test`, the mode of the key in use.
- `allowed_return_urls` (`string[]`): Where a connect link may send a person back to (`return_url`). Empty: no return URL is allowed.
- `allowed_embed_origins` (`string[]`): The https origins whose pages may show Bash in an iframe, and open a voice call.
- `default_deployment` (`string | null`): The deployment a conversation runs when neither it nor its user names one; null: Bash as it comes, with no deployment of yours.
- `require_user` (`boolean`): When true, a request that names no `user_id` answers 400 `user_required` instead of reaching the company's own Bash.
- `memory_panel` (`boolean`): Whether a session may show the user what Bash remembers (POST /v1/sessions with `memory: true`). Off until you turn it on.
- `memory_mode` (`"vestra" | "customer" | "none"`): Who keeps what Bash remembers about each user, unless a deployment says otherwise: `vestra` (Bash keeps it), `customer` (your side keeps it, at `memory_endpoint`) or `none`.
- `memory_endpoint` (`string | null`): With `memory_mode: customer`, the https URL Bash asks for what to remember about a user; null otherwise.
- `otlp_endpoint` (`string | null`): Where Bash sends its traces, as OpenTelemetry (OTLP over HTTP); null: none are sent.
- `otlp_headers_secret` (`string | null`): The name of your secret that holds the headers sent with each trace; its value is never returned. Null: none.
- `balance_usd` (`number`): This mode's wallet, in billed US dollars, up to 5 decimals. Work stops with 402 `wallet_empty` when it runs out.
- `caps` (`object`): This mode's spending caps, for the company and per user, per day and per month.
  - `org_daily_usd` (`number | null`): The company's spending cap per day (UTC), in US dollars, across all its users; null: none, up to the account's ceiling. Limits: 0 to 1000000.
  - `user_daily_usd` (`number | null`): The default cap per user per day (UTC), in US dollars; a user's own `spend_cap_usd` wins. Null: none. Limits: 0 to 1000000.
  - `max_org_daily_usd` (`number`): The highest the company's daily cap may be set, in US dollars. Ask Vestra to raise it. Limits: 0 to 1000000.
  - `org_monthly_usd` (`number | null`): The company's cap per calendar month (UTC), in US dollars. Null (the default): none. Limits: 0 to 1000000.
  - `user_monthly_usd` (`number | null`): The default cap per user per calendar month (UTC), in US dollars; a user's own `monthly_cap_usd` wins. Null (the default): none. Limits: 0 to 1000000.
- `usage_alerts` (`object`): When Bash tells your webhooks that spend is nearing a cap.
  - `thresholds` (`integer[]`): Percents of a cap at which `usage.threshold_reached` fires; reaching 100 always fires `usage.cap_reached`. Limits: at most 5 items.
- `created_at` (`string`): When the account was made, as an ISO 8601 date and time in UTC.

## Code

**HTTP**

```bash
# Describe the job, naming the deployment. Its questions arrive on the conversation the answer names: reply there, as the init line shows.
# A slug already taken (409 slug_taken, say by an init you stopped)? Send another, such as travel-desk-2.
curl "$VESTRA_BASE_URL/v1/deployments/interview" \
  -H "Authorization: Bearer $VESTRA_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{ "name": "Travel desk", "slug": "travel-desk", "job": "Answer questions from my travellers about their bookings. Look bookings up with get_booking." }'

# The interview saves the draft in test mode. Play its starter tests.
curl -X POST "$VESTRA_BASE_URL/v1/deployments/travel-desk/test-runs" \
  -H "Authorization: Bearer $VESTRA_API_KEY"

# Make it your default deployment: every ask below that names no deployment reaches it. This replaces any default you had.
curl -X PATCH "$VESTRA_BASE_URL/v1/org" \
  -H "Authorization: Bearer $VESTRA_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{ "default_deployment": "travel-desk" }'
```

**TypeScript, Python, CLI, MCP**: No sample in your language for this route, so here it is over HTTP.