---
search:
  tags:
    - Teams
    - PATCH
seo:
  description: >-
    User-gated (chrm_user_* or session); the caller must be an owner or…
    Reference for the PATCH /api/v1/teams/{teamId}/security endpoint in the
    Charming API.
sidebar:
  label: Update team security settings
  badge: PATCH
title: Update team security settings
type: openapi-operation
---
User-gated (`chrm_user_*` or session); the caller must be an owner or admin of the team. Turning `requireTwoFactor` on also needs two-factor authentication on the caller’s own account. Turning it off needs a session from a login in the last 10 minutes; a personal access token cannot turn it off.

`PATCH /api/v1/teams/{teamId}/security`

**Request body** (`application/json`, required)

- `requireTwoFactor` (boolean, required)

Request body example:

```json
{
  "requireTwoFactor": true
}
```

**Responses**

- `200` — Security settings updated.
- `400` — Invalid body.
- `401` — Sign-in required.
- `403` — The caller is not an owner or admin of this team (\`forbidden\`), is turning the requirement on without two-factor authentication on their own account (\`two\_factor\_required\`), or is turning it off without a login from the last 10 minutes (\`recent\_login\_required\`).

Response example, 200:

```json
{
  "ok": true,
  "security": {
    "requireTwoFactor": true,
    "membersWithoutTwoFactor": 0
  }
}
```

Found a bug or need a feature? [Tell us](/docs/capabilities/feedback) with `submit_feedback` or `POST /app/{id}/feedback`. Your feedback shapes what we build next.