update-customer

dci update-customer customerId

Partially updates the general settings and contact info of the customer identified by \{customerId\}. \{customerId\} must match the customer resolved from the bearer token; a token scoped to a different customer gets 403, even if that customer would otherwise be reachable through a reseller/MTS relationship. Requires the Settings permission and DoiT API access (platform:externalApi); updating allowedInviteDomains additionally requires the UsersManager permission.

The request body must use application/merge-patch+json (RFC 7396): an omitted field leaves the current value unchanged, and an explicit null also leaves it unchanged, except for urlSlug, where an explicit empty string removes the customer's active URL slug rather than leaving it unchanged.

Fields are nested exactly as getCustomer returns them - currency and allowedInviteDomains under settings, emails under contact - so every value is read and written at the same path. settings.currency accepts only the codes listed in the schema and cannot be cleared; allowedInviteDomains and contact.emails are cleared with an empty array.

Request

Content-Type: application/merge-patch+json

Schema

{
  "type": "object",
  "description": "Partial update to a customer's general settings. Every field is optional; only fields present in the request body are changed. Fields are nested exactly as the `getCustomer` response nests them. See the operation description for `urlSlug`'s null-vs-absent semantics, which differ from every other field.",
  "properties": {
    "urlSlug": {
      "type": "string",
      "description": "The customer's URL display name. An explicit empty string removes the active slug; a non-empty value must be 3-12 characters of lowercase letters, digits, or dashes, starting and ending with a letter or digit, and must be unique across all customers.",
      "x-doit-confidentiality": "customer-data"
    },
    "settings": {
      "type": "object",
      "description": "Customer settings. Shared by the `getCustomer` response and the `updateCustomer` request body so a value is always read and written at the same path.\n\n`currency` accepts only the listed codes; any other value is rejected with `400`. Unlike `urlSlug` and `allowedInviteDomains` it cannot be cleared - no value unsets it.",
      "properties": {
        "currency": {
          "description": "Currency code for monetary values.",
          "type": "string",
          "enum": [
            "USD",
            "ILS",
            "EUR",
            "AUD",
            "CAD",
            "GBP",
            "DKK",
            "NOK",
            "SEK",
            "BRL",
            "SGD",
            "MXN",
            "CHF",
            "MYR",
            "TWD",
            "EGP",
            "ZAR",
            "JPY",
            "IDR",
            "AED",
            "THB",
            "COP"
          ]
        },
        "allowedInviteDomains": {
          "type": "array",
          "description": "Email domains allowed to self-invite into the customer. Updating this field requires the `UsersManager` permission in addition to `Settings`. An empty array clears the list.",
          "items": {
            "type": "string"
          },
          "x-doit-pii": true,
          "x-doit-confidentiality": "customer-data"
        },
        "mfaRequired": {
          "type": "boolean",
          "description": "Whether users of this customer are required to enroll in multi-factor authentication. A missing value is treated as `true`. Disabling this does not remove MFA enrollments existing users already have.",
          "x-doit-confidentiality": "customer-data"
        }
      }
    },
    "contact": {
      "type": "object",
      "description": "Customer point-of-contact details. Shared by the `getCustomer` response and the `updateCustomer` request body so a value is always read and written at the same path.",
      "properties": {
        "emails": {
          "type": "array",
          "description": "Point-of-contact email addresses for the customer.",
          "items": {
            "type": "string",
            "format": "email"
          },
          "x-doit-pii": true,
          "x-doit-confidentiality": "customer-data"
        }
      }
    }
  }
}

Output

On success, this command produces no response data.

Errors

On failure, dci prints a single error message — with a hint when one is available — and exits with a typed code your scripts can branch on. See Errors and exit codes for the full contract.

HTTP status	Exit code	Error code	Meaning
400, 422	30	VALIDATION_ERROR	The arguments or request body were rejected. Review the command's flags and payload.
401	10	AUTHENTICATION_FAILED	Not signed in, or the API token is invalid. Run dci login or check DCI_API_KEY.
403	11	PERMISSION_DENIED	The DoiT user or the active customer context does not have access.
404	20	RESOURCE_NOT_FOUND	The requested resource does not exist. Check the identifier argument.
409	21	RESOURCE_CONFLICT	The operation conflicts with the resource's current state.
415	1	API_ERROR	The request failed; the printed error message has details.
500	40	API_SERVER_ERROR	The API failed to process the request. Retryable; contact DoiT support if it persists.

Aliases: updatecustomer