> ## Documentation Index > Fetch the complete documentation index at: https://docs.paywithlocus.com/llms.txt > Use this file to discover all available pages before exploring further. # Update tenant settings > Workspace owner/admin sessions and secret keys with tenant:write may update webhookUrl or feeMode. A new webhookUrl is queued for an isolated ownership challenge; the previously verified URL remains active until that challenge succeeds. Requests containing marginPayoutAddress or payoutMethod require a dashboard session from a workspace owner or admin with MFA or passkey step-up completed in the last ten minutes; every other principal receives 403. Changing marginPayoutAddress starts a 24-hour payout hold. ## OpenAPI ````yaml /api-reference/openapi.json put /credits/tenants/me openapi: 3.1.0 info: title: Locus Pro API description: >- Access paid tools, manage prepaid balances, and build usage billing. Send money as exact decimal strings and reuse Idempotency-Key on retries. Management routes require a scoped server key or authorized dashboard session. Sensitive workspace changes require an owner or admin with recent MFA or passkey verification, except where an operation documents a stricter boundary. Interactive agents use MCP OAuth; unattended agents use scoped Agent Connections. Browser widgets use end-user tokens. version: 0.7.0 servers: - url: https://api.paywithlocus.com/api description: Production - url: https://api.stage.paywithlocus.com/api description: Stage — evaluation and integration testing security: - secretKey: [] tags: - name: Authentication description: Email-verified self-serve account creation and dashboard identity - name: Tenants description: Tenant profile, keys, and settings (dashboard session or secret key) - name: Workspace members description: Invite-only human workspace membership and role administration - name: Catalog description: Enable/disable APIs and set markups - name: Custom APIs description: Feature-gated enterprise BYOK providers and schema-backed custom actions - name: End users description: End-user accounts, tokens, and allocations - name: Top-ups description: Locus-hosted checkout top-ups and quotes - name: Ledger description: Burn/top-up history and earnings - name: Webhooks description: Signed events, delivery inspection, and replay - name: Burn description: Metered pay-per-use calls - name: MCP description: Stateless Streamable HTTP transport and MCP tool-result contracts - name: Okibi Identity description: >- Feature-gated Okibi identity verification and scoped native CLI credential bootstrap - name: Widget description: End-user JWT surface; a matching publishable key is optional - name: Agent-native onboarding description: >- Self-registration, human Stripe funding handoff, and restricted account setup for headless agents - name: Hosted Workflows description: >- Tenant-private TypeScript Workflow definitions, immutable versions, bounded runs, artifacts, and recovery - name: Agent connections description: Scoped, expiring, revocable credentials for agent execution - name: Recipes description: >- Search, research, extraction, enrichment, and travel outcomes across providers paths: /credits/tenants/me: put: tags: - Tenants summary: Update tenant settings description: >- Workspace owner/admin sessions and secret keys with tenant:write may update webhookUrl or feeMode. A new webhookUrl is queued for an isolated ownership challenge; the previously verified URL remains active until that challenge succeeds. Requests containing marginPayoutAddress or payoutMethod require a dashboard session from a workspace owner or admin with MFA or passkey step-up completed in the last ten minutes; every other principal receives 403. Changing marginPayoutAddress starts a 24-hour payout hold. parameters: - $ref: '#/components/parameters/WorkspaceStepUpHeader' requestBody: required: true content: application/json: schema: type: object properties: webhookUrl: type: - string - 'null' format: uri feeMode: type: string enum: - pass_through - absorb marginPayoutAddress: type: - string - 'null' pattern: ^0x[a-fA-F0-9]{40}$ description: >- Dashboard-session only. A change starts a 24-hour payout hold. payoutMethod: type: string enum: - usdc - stripe description: Dashboard-session only. additionalProperties: false responses: '200': description: Settings updated; no webhook ownership challenge is pending '202': description: Settings updated and webhook ownership verification queued content: application/json: schema: type: object required: - success - tenant - webhookVerification properties: success: const: true tenant: $ref: '#/components/schemas/Tenant' webhookVerification: $ref: '#/components/schemas/WebhookVerification' '400': description: Invalid setting or one or more unknown fields content: application/json: schema: oneOf: - $ref: '#/components/schemas/UnknownTenantFieldsError' - type: object required: - success - error - message properties: success: const: false error: const: Bad Request message: type: string '403': description: >- INSUFFICIENT_SCOPE, STEP_UP_REQUIRED for a payout-setting change, a secret key attempted a dashboard-only payout change, or payouts are locked for an evaluation workspace security: - dashboardSession: [] - secretKey: [] components: parameters: WorkspaceStepUpHeader: name: X-Locus-Step-Up in: header required: false schema: type: string format: password description: >- Short-lived raw MFA/passkey step-up token bound to the authenticated Cognito subject. Send it alongside the dashboard Bearer token for workspace-administrator mutations when the base session does not itself prove MFA within the last ten minutes. Never send it with a tenant secret key. schemas: Tenant: type: object properties: id: type: string format: uuid name: type: string status: type: string enum: - active - suspended secretKeyPrefix: type: string example: lcr_live_ab12 publishableKeyPrefix: type: string example: lcrpk_live_cd34 defaultMarkupBps: type: integer feeMode: type: string enum: - pass_through - absorb provisioningSource: type: string enum: - operator - self_serve - system creditsPerDollar: type: integer WebhookVerification: type: object required: - id - destinationUrl - status - attempts - scheduledAt - verifiedAt - error properties: id: type: string format: uuid destinationUrl: type: string format: uri status: type: string enum: - pending - verifying - verified - failed - superseded attempts: type: integer minimum: 0 maximum: 5 scheduledAt: type: string format: date-time verifiedAt: type: - string - 'null' format: date-time error: type: - string - 'null' additionalProperties: false UnknownTenantFieldsError: type: object additionalProperties: false required: - success - error - code - fields - message properties: success: const: false error: const: Bad Request code: const: unknown_fields fields: type: array items: type: string minItems: 1 uniqueItems: true message: type: string securitySchemes: secretKey: type: http scheme: bearer description: Tenant secret key (lcr_…). Server-side only. dashboardSession: type: http scheme: bearer description: >- Locus Pro dashboard session (Cognito). High-risk workspace administration requires an owner or admin role and fresh MFA/passkey step-up. ```` This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.