TracePass
Get started
Regulatory assistant

Update compliance profile

Merges the provided fields into the stored compliance profile and returns the updated profile with `updatedAt`. Fields not included in the request are left unchanged. Set a field to `null` to remove it. Validated fields: `role` (`manufacturer`, `importer`, `distributor`, `authorised_representative`, `fulfilment_service_provider`), `ownBrand` (boolean), `categories` (array of template category keys), `markets` (array of ISO-3166-1 alpha-2 codes or `EU`), `products` (array of `{name, category, facts}`, at most 50), `sizeBand` (`sme` or `large`), `salesChannels` (array of `own_shop`, `marketplace`, `retail`, `b2b`, `fulfilment`), `dataSystems` (string, at most 200 chars). An invalid value returns 400 `invalid_input`.

PATCH/api/v1/company/compliance-profile
Download OpenAPI 3.1
PATCH/api/v1/company/compliance-profile

Update compliance profile

Merges the provided fields into the stored compliance profile and returns the updated profile with `updatedAt`. Fields not included in the request are left unchanged. Set a field to `null` to remove it. Validated fields: `role` (`manufacturer`, `importer`, `distributor`, `authorised_representative`, `fulfilment_service_provider`), `ownBrand` (boolean), `categories` (array of template category keys), `markets` (array of ISO-3166-1 alpha-2 codes or `EU`), `products` (array of `{name, category, facts}`, at most 50), `sizeBand` (`sme` or `large`), `salesChannels` (array of `own_shop`, `marketplace`, `retail`, `b2b`, `fulfilment`), `dataSystems` (string, at most 200 chars). An invalid value returns 400 `invalid_input`.

Auth: an API key or OAuth with `passports:write`. For OAuth principals, the user must have the `admin` or `owner` role (same rule as the dashboard compliance-profile page). API keys are not role-gated. Counts no scope answer (this is a profile write, not a regulatory query).

Headers

  • Authorizationrequired

    string

    `Bearer <token>` — either a `tp_` API key (Developer → API Keys; simplest, for server-to-server) or an OAuth 2.0 access token (Developer → OAuth Apps; for user-authorized apps, scoped + revocable). The Authentication page has the full OAuth flow and scope list.

    e.g. Bearer tp_REDACTED_xxxxxxxxxxxx

Body fields

  • role

    string

    Company's role in the supply chain — `manufacturer`, `importer`, `distributor`, `authorised_representative`, or `fulfilment_service_provider`.

    e.g. manufacturer

  • categories

    string[]

    Array of template category keys the company deals with.

  • markets

    string[]

    ISO-3166-1 alpha-2 country codes or `EU` for all EU markets.

  • sizeBand

    string

    Company size — `sme` or `large`.

    e.g. sme

Request

curl -sS https://app.tracepass.eu/api/v1/company/compliance-profile \
  -X PATCH \
  -H "Authorization: Bearer tp_REDACTED_xxxxxxxxxxxx" \
  -H "Content-Type: application/json" \
  -d '{"role":"manufacturer","categories":["battery"],"markets":["EU"],"sizeBand":"sme"}'

Response

{
  "complianceProfile": {
    "role": "manufacturer",
    "categories": ["battery"],
    "markets": ["EU"],
    "sizeBand": "sme"
  },
  "updatedAt": "2026-10-11T19:01:12.152Z"
}

Related endpoints