---
title: Update compliance profile
description: "Merge company facts into the DPP compliance profile — role, categories, markets, size band, and more. Requires passports:write and admin role for OAuth."
canonical: "https://www.tracepass.eu/docs/patch-compliance-profile"
locale: en
source: "https://www.tracepass.eu/docs/patch-compliance-profile"
---

# Update compliance profile

> Merge company facts into the DPP compliance profile — role, categories, markets, size band, and more. Requires passports:write and admin role for OAuth.

```http
PATCH /api/v1/company/compliance-profile
```

Merges the provided fields into the stored compliance profile and returns the updated profile with `updatedAt`. Fields not included in the request are left unchanged. Set a field to `null` to remove it. Validated fields: `role` (`manufacturer`, `importer`, `distributor`, `authorised_representative`, `fulfilment_service_provider`), `ownBrand` (boolean), `categories` (array of template category keys), `markets` (array of ISO-3166-1 alpha-2 codes or `EU`), `products` (array of `{name, category, facts}`, at most 50), `sizeBand` (`sme` or `large`), `salesChannels` (array of `own_shop`, `marketplace`, `retail`, `b2b`, `fulfilment`), `dataSystems` (string, at most 200 chars). An invalid value returns 400 `invalid_input`.

Auth: an API key or OAuth with `passports:write`. For OAuth principals, the user must have the `admin` or `owner` role (same rule as the dashboard compliance-profile page). API keys are not role-gated. Counts no scope answer (this is a profile write, not a regulatory query).

## Parameters

| Name | In | Type | Required | Description |
| --- | --- | --- | --- | --- |
| `Authorization` | header | string | yes | `Bearer <token>` — either a `tp_` API key (Developer → API Keys; simplest, for server-to-server) or an OAuth 2.0 access token (Developer → OAuth Apps; for user-authorized apps, scoped + revocable). The Authentication page has the full OAuth flow and scope list. |
| `role` | body | string | no | Company's role in the supply chain — `manufacturer`, `importer`, `distributor`, `authorised_representative`, or `fulfilment_service_provider`. |
| `categories` | body | string\[\] | no | Array of template category keys the company deals with. |
| `markets` | body | string\[\] | no | ISO-3166-1 alpha-2 country codes or `EU` for all EU markets. |
| `sizeBand` | body | string | no | Company size — `sme` or `large`. |

## Examples

```bash
curl -sS https://app.tracepass.eu/api/v1/company/compliance-profile \
  -X PATCH \
  -H "Authorization: Bearer tp_REDACTED_xxxxxxxxxxxx" \
  -H "Content-Type: application/json" \
  -d '{"role":"manufacturer","categories":["battery"],"markets":["EU"],"sizeBand":"sme"}'
```

```typescript
const res = await fetch("https://app.tracepass.eu/api/v1/company/compliance-profile", {
  method: "PATCH",
  headers: {
    Authorization: `Bearer ${process.env.TRACEPASS_API_KEY}`,
    "Content-Type": "application/json",
  },
  body: JSON.stringify({
    role: "manufacturer",
    categories: ["battery"],
    markets: ["EU"],
    sizeBand: "sme",
  }),
});
const { complianceProfile, updatedAt } = await res.json();
```

```python
import os, requests
resp = requests.patch(
    "https://app.tracepass.eu/api/v1/company/compliance-profile",
    headers={
        "Authorization": f"Bearer {os.environ['TRACEPASS_API_KEY']}",
        "Content-Type": "application/json",
    },
    json={"role": "manufacturer", "categories": ["battery"], "markets": ["EU"]},
)
data = resp.json()
```

## Responses

### 200 — Updated profile

```json
{
  "complianceProfile": {
    "role": "manufacturer",
    "categories": ["battery"],
    "markets": ["EU"],
    "sizeBand": "sme"
  },
  "updatedAt": "2026-10-11T19:01:12.152Z"
}
```

### 400 — Invalid value

```json
{ "error": "invalid_input", "field": "role", "message": "Invalid option: expected one of \"manufacturer\"|\"importer\"|\"distributor\"|\"authorised_representative\"|\"fulfilment_service_provider\"" }
```

### 401 — Unauthorized

```json
{ "error": "Invalid or revoked API key" }
```

### 403 — Admin role required

```json
{ "error": "Forbidden", "message": "admin role required to update the compliance profile" }
```

## Related

- [GET Read compliance profile](https://www.tracepass.eu/docs/get-compliance-profile.md)
- [DELETE Delete compliance profile](https://www.tracepass.eu/docs/delete-compliance-profile.md)