> ## Documentation Index > Fetch the complete documentation index at: https://developers.conveyour.com/llms.txt > Use this file to discover all available pages before exploring further. # Update compliance configuration > Updates the compliance configuration settings for your org. Accepts the same keys returned by `GET /api/compliance/config`. Update org compliance settings **Permission:** Org **admin** only. Denials read `Manage Compliance`. **Not callable with an API key.** Requires an org **admin**. Service accounts cannot be assigned the admin role and their role cannot be changed, so every API key gets `403`. Only a signed-in admin can call it. ## OpenAPI ````yaml /api-reference/specs/compliance.json put /api/compliance/config openapi: 3.1.0 info: title: ConveYour API — Compliance description: >- Run real-time compliance checks on contacts to confirm completed lessons and form submissions. version: 1.0.0 servers: - url: https://{subdomain}.conveyour.com description: Your organization's ConveYour instance variables: subdomain: default: acme description: >- Your organization's slug — the subdomain you sign in on. Replace `acme` with yours: if you sign in at `bigco.conveyour.com`, enter `bigco`. security: - conveyourToken: [] tags: - name: Compliance description: >- Run real-time compliance checks on contacts to confirm completed lessons and form submissions. paths: /api/compliance/config: put: tags: - Compliance summary: Update compliance configuration description: >- Updates the compliance configuration settings for your org. Accepts the same keys returned by `GET /api/compliance/config`. Update org compliance settings **Permission:** Org **admin** only. Denials read `Manage Compliance`. **Not callable with an API key.** Requires an org **admin**. Service accounts cannot be assigned the admin role and their role cannot be changed, so every API key gets `403`. Only a signed-in admin can call it. operationId: updateOrgComplianceSettings parameters: - $ref: '#/components/parameters/teams' requestBody: required: false content: application/json: schema: type: object properties: enabled: description: Enable or disable compliance for this org. type: boolean callback_url: description: Default webhook URL for async compliance results. type: string lesson_tags_all: description: Lessons must have every tag in this list to be in scope. type: array items: type: string lesson_tags_any: description: >- Lessons must have at least one tag in this list to be in scope. type: array items: type: string completed_after: description: >- Relative time window for lesson completions (e.g. `"-1 year"`). type: string released_only: description: When `true`, only released lessons count toward compliance. type: boolean released_after: description: 'Optional: only lessons released after this time count.' type: string submission_enabled: description: Include form submissions in compliance scoring. type: boolean submission_completed_statuses: description: Submission statuses that count as completed. type: array items: type: string submission_collection_ids: description: Limit scoring to specific submission collection IDs. type: array items: type: string responses: '200': description: Success. content: application/json: schema: allOf: - $ref: '#/components/schemas/Envelope' - type: object properties: data: $ref: '#/components/schemas/ComplianceConfiguration' example: status: ok message: Compliance configuration updated data: enabled: true lesson_tags_all: - required-training completed_after: '-1 year' released_only: true submission_enabled: true submission_completed_statuses: - completed '403': $ref: '#/components/responses/Forbidden' components: parameters: teams: name: teams[] in: query description: >- Team scope for the request, as one or more team ObjectIds. The brackets are required: PHP keeps only the last value for a repeated plain key, so `teams=A&teams=B` silently resolves to B alone. On requests with a JSON body you may send `teams` (no brackets) in the body instead. **Values that are not valid ObjectIds are silently ignored** — a mistyped team ID behaves as if no team was sent. See the [teams section of the API conventions guide](/guides/api-conventions#team-scoping). style: form explode: true schema: type: array items: type: string example: - 64a1b2c3d4e5f6a7b8c9d0ff schemas: Envelope: type: object description: The common response envelope shared by all ConveYour endpoints. properties: status: type: string enum: - ok - failed description: '`ok` on success, `failed` on error.' message: type: string description: Human-readable description of the result. data: description: >- The response payload — an object or an array depending on the endpoint. ComplianceConfiguration: type: object description: Compliance configuration. All fields are. properties: enabled: type: boolean description: Whether compliance checking is on. callback_url: type: string description: URL notified when a run completes. released_debounce: type: string description: Debounce window for release events. content_enabled: type: boolean description: Whether lesson content is included. include_lessons: type: boolean description: Include lesson completion in the check. lesson_tags_all: type: array description: Lesson must carry every one of these tags. lesson_tags_any: type: array description: Lesson must carry at least one of these tags. completed_after: type: string description: Only count completions after this point. released_only: type: boolean description: Restrict to released content. released_after: type: string description: Only count releases after this point. include_submissions: type: boolean description: Include form submissions in the check. submission_enabled: type: boolean description: Whether submission checking is on. submission_completed_statuses: type: array description: Submission statuses that count as complete. submission_collection_ids: type: array description: Submission collections included in the check. responses: Forbidden: description: >- The token is missing or invalid, or the service account behind it lacks the permission this endpoint requires. content: application/json: example: status: failed message: Lacking necessary permission add_contacts data: permission: add_contacts securitySchemes: conveyourToken: type: apiKey in: header name: x-conveyour-token description: >- Your API key token. Contacts endpoints require a **Server-only — Full API** key — see [Authentication](/quickstart). ```` This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.