> ## Documentation Index > Fetch the complete documentation index at: https://docs.go.aiinsurance.io/llms.txt > Use this file to discover all available pages before exploring further. # Update Entity > Updates a `{entityType}` entity. The request body is a flat JSON object with field `referenceId`s as keys — the same shape as create. Provided fields are **merged** onto the existing `fieldModelV1Data`; a key set to `null` clears that field. Fields you omit are left unchanged. Updates are **`PATCH` only — never `PUT`.** A `PUT` to this resource is rejected with `405 Method Not Allowed` and an `Allow: PATCH` header (the handler does a partial merge, which is PATCH semantics; PUT would imply full replacement, which these endpoints do not do). **Required permission:** `company.{entity}:update` — the exact key varies by type. See [Permissions](/api-reference/entities/overview#permissions). ## OpenAPI ````yaml /openapi/generated-external-api.yaml patch /api/v1/companies/{companyId}/entities/{entityType}/{entityId} openapi: 3.0.3 info: title: AI Insurance External API description: External API for AI Insurance platform version: 1.0.0 contact: email: support@aiinsurance.io servers: - url: https://go.aiinsurance.io description: Production security: - ApiKeyAuth: [] paths: /api/v1/companies/{companyId}/entities/{entityType}/{entityId}: patch: tags: - Entities summary: Update Entity description: > Updates a `{entityType}` entity. The request body is a flat JSON object with field `referenceId`s as keys — the same shape as create. Provided fields are **merged** onto the existing `fieldModelV1Data`; a key set to `null` clears that field. Fields you omit are left unchanged. Updates are **`PATCH` only — never `PUT`.** A `PUT` to this resource is rejected with `405 Method Not Allowed` and an `Allow: PATCH` header (the handler does a partial merge, which is PATCH semantics; PUT would imply full replacement, which these endpoints do not do). **Required permission:** `company.{entity}:update` — the exact key varies by type. See [Permissions](/api-reference/entities/overview#permissions). operationId: updateEntity parameters: - $ref: '#/components/parameters/companyId' - $ref: '#/components/parameters/crudEntityType' - $ref: '#/components/parameters/entityIdPath' requestBody: required: true content: application/json: schema: type: object additionalProperties: true description: >- Flat JSON object with field referenceIds as keys (merged onto existing data) examples: updateFields: summary: Update fields value: exposureName: Acme Corp Headquarters clearField: summary: Clear a field value: exposureName: null responses: '200': description: Entity updated successfully content: application/json: schema: type: object properties: id: type: string format: uuid description: The ID of the updated entity examples: success: summary: Entity updated value: id: 550e8400-e29b-41d4-a716-446655440301 '400': description: Bad Request - Validation error content: application/json: schema: $ref: '#/components/schemas/ErrorResponse' examples: invalidOptionSet: summary: Invalid option set value value: error: code: InvalidFieldModelV1Data message: >- fieldModelV1Data: Field 'exposureType' value 'Bad Value' is not a valid option. Valid options: person, company userMessages: - >- Field 'exposureType' value 'Bad Value' is not a valid option. Valid options: person, company details: - field: fieldModelV1Data message: >- Field 'exposureType' value 'Bad Value' is not a valid option. Valid options: person, company '401': $ref: '#/components/responses/Unauthorized' '403': $ref: '#/components/responses/Forbidden' '404': description: Entity not found content: application/json: schema: $ref: '#/components/schemas/ErrorResponse' examples: entityNotFound: summary: Entity not found value: error: code: NotFoundError message: Entity not found userMessages: - Entity not found '405': description: Method Not Allowed - PUT is not supported (use PATCH) headers: Allow: description: The methods this resource accepts for updates. schema: type: string example: PATCH content: application/json: schema: $ref: '#/components/schemas/ErrorResponse' examples: putNotAllowed: summary: PUT rejected — use PATCH value: error: code: METHOD_NOT_ALLOWED message: Method Not Allowed. Use PATCH. '409': description: > The update changes a **flow-written status field** this endpoint cannot move (`GuardedStatusFieldWrite`). Sending the value the field already holds is always accepted; changing it is not. Today that is `Event.eventStatus`: close and re-open an event with `POST /events/{eventId}/close` and `POST /events/{eventId}/reopen`, which move the status and append to the event's open/close-history log in one transaction. The error message names the action to use. Setting the field on **create** is unaffected. content: application/json: schema: $ref: '#/components/schemas/ErrorResponse' examples: guardedStatusField: summary: eventStatus cannot be changed by a generic update value: error: code: GuardedStatusFieldWrite message: >- eventStatus cannot be changed from 'open' to 'closed' via a generic entity update: the field is flow-written. Use the dedicated close-event / reopen-event actions (a generic status write would skip the open/close-history log). userMessages: - >- eventStatus cannot be changed from 'open' to 'closed' via a generic entity update: the field is flow-written. Use the dedicated close-event / reopen-event actions (a generic status write would skip the open/close-history log). '500': $ref: '#/components/responses/InternalServerError' components: parameters: companyId: name: companyId in: path required: true schema: type: string format: uuid description: Company identifier crudEntityType: name: entityType in: path required: true schema: type: string enum: - event - exposure - quote - submission - person - organization description: > Field Model V1 entity type (lowercase kebab-case URL slug). One of the six CRUD entity types: `event`, `exposure`, `quote`, `submission`, `person`, `organization`. `policy` is NOT valid here — Policy has no generic CRUD (its writes go through the policy transaction endpoints), though it does have a read-only `/configuration` schema. entityIdPath: name: entityId in: path required: true schema: type: string format: uuid description: Entity identifier schemas: ErrorResponse: type: object description: Standard error response for all external API endpoints required: - error properties: error: type: object required: - code - message properties: code: type: string description: Machine-readable error code example: VALIDATION_ERROR message: type: string description: Human-readable error message example: 'submissionId: Required field is missing' userMessages: type: array description: >- Clean, verbatim-displayable messages — one entry per failure, free of error-code tags, field paths, and internal noise. Suitable for showing to end users as-is. items: type: string example: - Exposures of type 'company' require an address details: type: array description: Additional details for validation errors (field-level errors) items: type: object properties: field: type: string description: The field that caused the error example: submissionId message: type: string description: Description of the field error example: Required field is missing responses: Unauthorized: description: Unauthorized - Invalid or missing API key content: application/json: schema: $ref: '#/components/schemas/ErrorResponse' examples: missingApiKey: summary: Missing API key value: error: code: AuthenticationError message: API key authentication required userMessages: - API key authentication required invalidApiKey: summary: >- Invalid API key (e.g. unknown key, or a Bearer token used instead of an API key) value: error: code: AuthenticationError message: Invalid API key userMessages: - Invalid API key Forbidden: description: Forbidden - Insufficient permissions content: application/json: schema: $ref: '#/components/schemas/ErrorResponse' examples: insufficientPermissions: summary: Insufficient permissions value: error: code: AuthorizationError message: User is not authorized to perform the requested action userMessages: - User is not authorized to perform the requested action companyMismatch: summary: A valid API key naming another company in the URL value: error: code: AuthorizationError message: API key is not scoped to the requested company userMessages: - API key is not scoped to the requested company InternalServerError: description: Internal Server Error - Unexpected error occurred content: application/json: schema: $ref: '#/components/schemas/ErrorResponse' examples: internalError: summary: Unexpected server error value: error: code: UncaughtActionError message: Uncaught error occurred in userMessages: - An unexpected error occurred. Please try again later. securitySchemes: ApiKeyAuth: type: apiKey in: header name: Authorization description: >- API key authentication. Send your raw API key as the `Authorization` header value with NO scheme prefix — `Authorization: YOUR-API-KEY`. Do NOT prefix it with `Bearer ` or `ApiKey `, and do not use an `X-API-Key` header; those are not accepted. ````