Skip to main content

​
Settings

Manage your organization’s display settings and brand assets.

​
Update Settings

This endpoint requires a session cookie - API key authentication is not currently supported for settings updates.
​
string
Your display name
​
string
Organization name
​
string
Your job role
​
boolean
Turn email-domain auto-join on or off for the organization. Owners/admins only.
​
string[]
Allowed email domains for auto-join (e.g. ["acme.com"]). Generic providers (gmail.com, outlook.com, etc.) are rejected.
​
boolean
Email the org when a candidate submits an assessment.
​
string
Free-text description of the company, used to ground AI generation. Trimmed; an empty string clears it.
​
boolean
Org-wide toggle for capturing candidate session replays.

​
Set an Internal Rollout Flag

Turn one internal rollout flag on or off for a named organization. Backs the staff-only Settings → Feature Flags console.
This is the one endpoint that deliberately crosses the tenant boundary: it writes to an organization the caller need not belong to. Gated on Gradient staff by exact email against the staff_members table, a dedicated table whose only sanctioned writer is src/lib/auth/staff.ts (enforced by scripts/check-staff-writes.ts in CI). Non-staff callers get 404, so the endpoint is not discoverable.
​
string
required
The target organization’s id. Required and explicit; there is no “current organization” fallback. The audit row records this alongside the acting staff member.
​
string
required
Registry key of the flag, e.g. workspaceV2Enabled. Must be declared in the flag registry with audience: "internal".
​
boolean
required
New value. Must be a literal true or false.
Customer-facing flags are rejected here at any privilege level. captureReplaysEnabled, emailBrandingEnabled, autoJoinEnabled, notifyOnSubmit, captureDeliverableHistoryEnabled and atsIntegrationsEnabled are the organization’s own decision, and several carry consent or validation obligations that live on their own settings pages (the session-replay consent warning, the auto-join domain rules and Stytch sync). They are changed via PATCH /api/settings by that organization’s own owners and admins.
Every accepted change is appended to org_flag_changes with the acting staff member’s email, and appears in the console’s Change log.

​
Roll an Internal Flag Out to Every Organization

Set one internal rollout flag to the same value for every organization, in one call. Backs the “Roll out to all” and “Turn off everywhere” controls in the staff-only Settings → Feature Flags console. Use PATCH above to move a single organization.
Same two gates as PATCH, and the audience check matters more here rather than less: “turn session replay on for every organization” would be a consent decision for every tenant made in one click. Customer-facing flags are rejected at any privilege level.
​
string
required
Registry key of the flag. Must be declared with audience: "internal".
​
boolean
required
The value every organization should end up with.
Organizations already resolving to value are skipped rather than rewritten, including those riding the registry default — writing an explicit value that matches the default adds a key that says nothing and turns the change log into noise. A failure on one organization does not abort the rest; the response reports counts and names what failed, so a partial result is never presented as success.

​
Upload Logo or Wordmark

Upload a square logo or horizontal wordmark for your organization. The image is stored in Supabase storage and the URL is saved to the organization record.
Requires session cookie with owner or admin role.
​
file
required
Image file (PNG, JPG, SVG, or WebP). Max 2 MB.
​
string
required
Either logo (square icon) or wordmark (horizontal lockup).

​
Remove Logo or Wordmark

Remove a previously uploaded logo or wordmark.
Requires session cookie with owner or admin role.
​
string
required
Either logo or wordmark.

​
Preview Branded Invite Email

Requires admin role (owner or admin).
Renders the real candidate invite email (the same builder that sends it) with the supplied branding values — which may be unsaved edits from the Branding settings form — so the settings page can show a truthful live preview. The Gradient logo (shown only when no wordmark is set) is inlined as a data URI so it renders in-browser.
​
string
Company name shown in the copy/subject. Falls back to the saved org name.
​
string
Public wordmark URL to render on a white header. Omit/null for the Gradient header.
​
string
#rrggbb accent applied to the stripe and button. Ignored when not a valid hex.
​
string
Custom first sentence. Blank uses the default org/role sentence.

​
Upload Profile Photo

Upload a profile photo for the signed-in user. The image is stored in Supabase storage and the URL is saved to the user record, replacing the initials avatar shown in the top bar.
Requires an admin-portal session cookie. Candidate sessions are rejected.
​
file
required
Image file (PNG, JPG, or WebP). Max 5 MB.

​
Remove Profile Photo

Remove the signed-in user’s profile photo, reverting to initials.
Requires an admin-portal session cookie. Candidate sessions are rejected.