Update Me

Field	Type	Description
operator_name	string | null	Operator legal name (1–200 chars)
operator_address_street	string | null	Operator address — street
operator_address_postal_code	string | null	Operator address — postal code
operator_address_city	string | null	Operator address — city
operator_address_full	string | null	Operator address — single-line fallback (optional)
operator_country	string | null	ISO 3166-1 alpha-2 country code (e.g. GB)
operator_email	string | null	Operator contact email (RFC 5321; ≤ 320 chars)
operator_eori	string | null	EORI number: 2-letter country code + up to 15 alphanumeric chars (e.g. GB123456789000)
operator_identifier_type	"EORI" | "VAT" | null	Identifier scheme for the EORI/VAT value
operator_phone	string | null	E.164 phone number, no spaces (e.g. +441234567890)
default_activity_type	"DOMESTIC" | "IMPORT" | "EXPORT" | null	Default EUDR activity type for new DDS records
default_country_of_activity	string | null	Default country of activity for IMPORT/EXPORT — EU-27 or XI only
default_geo_location_confidential	boolean | null	Default geo-location confidentiality flag for new DDS records

These rules are enforced against the resulting profile as a whole:

Condition	Why
default_activity_type: "DOMESTIC" together with a default_country_of_activity	A DOMESTIC declaration derives its country from the operator's own, so a country of activity is meaningless. Switching to DOMESTIC without naming a country instead clears any stored one.
default_activity_type of IMPORT/EXPORT while the operator is identified by VAT	TRACES rejects a VAT-identified operator on an import/export DDS (GAP-25).
Any non-IMPORT default_activity_type while operator_country is outside the EU-27 + XI	A non-EU operator may only file an IMPORT DDS (GAP-26).

The two rules arm differently:

• the DOMESTIC rule applies whenever the request includes default_activity_type or default_country_of_activity, whether or not the value changes;
• the GAP-25/26 rules apply only when the request changes default_activity_type, operator_identifier_type or operator_country.

So a pre-existing bad operator/activity combination is tolerated on an unrelated write — editing something else is never blocked by state you did not touch — and the submit gate remains the backstop that stops such a profile reaching TRACES.

Exception — read-modify-write stays idempotent. When the stored profile already holds DOMESTIC beside a default_country_of_activity (only reachable from a writer outside this API), re-sending that same country while the profile stays DOMESTIC is treated as a no-op repair: the request succeeds and the stored country is cleared, rather than failing on every retry. A request that also moves the activity type to IMPORT/EXPORT keeps the country, because the pair is then consistent; the GAP-25/26 rules above still apply to the new activity type.

The operator values become the fallback operator block for POST /regulations/eudr/audit-trail when the create body omits operator.

A DDS record created without an operator block resolves its operator live from these defaults — its report auto-updates as you change them here — until the record is submitted, at which point the operator is frozen onto the version. A record created with an explicit operator block keeps that static override and does not track these defaults.

Existing records: records created before live-resolution shipped — and any record created with an explicit operator — hold a frozen operator snapshot and will not start tracking changes you make here. Only records created without an operator block pick up live updates. (No automatic backfill is performed; this is the safe backward-compatible default.)

When operator fields change while the organisation still has open (not-yet-submitted) DDS records, an operator.defaults_changed event is written to each open record's audit log with the before/after diff — so a later submission that freezes the (now-different) operator stays traceable. The change is allowed, not blocked.

The response includes read-only fields name, plan, tier, and domain which cannot be modified through this endpoint.

Required scope: organizations:write