---
updatedAt: 2026-09-30T17:50:34.235Z
---

Fetch the complete documentation index at: https://docs.avvio.xyz/llms.txt. Use this file to discover all available pages before exploring further. Append .md to any documentation page URL to get its markdown version.

# Update a recipient

`PATCH https://api.avvio.xyz/business/api/v1/recipients/{orgId}/{recipientId}`

Correct a recipient's own details.

Contact details only: name, email, phone, country, individual/business.
An empty `name`, `email` or `country` is ignored rather than clearing
the value; `phone: ""` clears the phone.

**The bank account behind a payment method cannot be edited, by
design.** The rail validated that account; silently swapping it would
send the next payout somewhere you never registered. A wrong account is
a new payment method, and the old one is deleted.

## Parameters

- `orgId` (path, required) — The opaque organization id issued to you, normally CUID-shaped (for example `cmsx…`). It is not an `org_`-prefixed alias. Pass it unchanged in every organization-scoped path.
- `Idempotency-Key` (header) — Same semantics as `Idempotency-Key` on the money routes (replay on the same body, `409` on a different one, released by a `4xx`), but optional here: without it the request simply runs once with no replay. Every `POST`, `PATCH` and `DELETE` honors it; send one whenever your client might retry.
- `recipientId` (path, required) — Opaque recipient id returned by this API. Pass it unchanged.

## Example

```bash
IDEMPOTENCY_KEY=$(uuidgen)  # new key per call; reuse it only to retry this exact request
curl -s -X PATCH "$AVVIO_BASE_URL/recipients/$AVVIO_ORG_ID/$recipientId" \
  -H "x-api-key: $AVVIO_API_KEY" \
  -H "Idempotency-Key: $IDEMPOTENCY_KEY" \
  -H "content-type: application/json" \
  -d '{
        "type": "individual"
      }'
```

## Responses

- `200` — The updated recipient
- `400` — Validation failed
- `401` — The key was refused. Nothing ran. - `UNAUTHORIZED`: missing, invalid or revoked, or a key on a route that does not accept one. - `KEY_EXPIRED`: the key passed the expiry it was issued with. Issue a new one; an expired key cannot be rotated. - `KEY_IP_NOT_ALLOWED`: the key is pinned to source addresses and this request came from another.
- `403` — A valid key that may not make this write. Nothing was changed. - `FORBIDDEN`: the key belongs to a different organization. - `ACCOUNT_BLOCKED`: API access for your organization is suspended. - `LIVE_KEY_ORG_NOT_APPROVED`: a live key, before we have approved your business verification. Use a test key until then. - `INSUFFICIENT_SCOPE`: a read-only key. Issue one with the `write` scope.
- `404` — Unknown recipient
- `429` — Too many requests. The default ceiling is **100 requests per minute per API credential** on a 60-second window. High-volume payout and reconciliation routes declare a 600/minute override, and batch submission a 30/minute ceiling. A separate 2,000/minute per-source-IP abuse ceiling always applies. Obey `Retry-After`; it is in seconds and is authoritative. A 429 means the request was refused before the handler ran. Retry reads normally; retry an idempotent mutation with its same `Idempotency-Key`.

Machine contract: [partner-payouts.openapi.yaml](/partner-payouts.openapi.yaml), operation `updateBeneficiary`.