A valid request URL is required to generate request examples{
"logo_url": "<string>",
"tokens": {
"light": {
"colorPrimary": "#4f46e5",
"colorPrimaryText": "<string>",
"colorText": "<string>",
"colorMuted": "<string>",
"colorBackground": "<string>",
"colorBorder": "<string>",
"colorDanger": "<string>",
"borderRadius": "0.5rem",
"fontFamily": "\"Inter var\", ui-sans-serif, system-ui, sans-serif"
},
"dark": {
"colorPrimary": "#4f46e5",
"colorPrimaryText": "<string>",
"colorText": "<string>",
"colorMuted": "<string>",
"colorBackground": "<string>",
"colorBorder": "<string>",
"colorDanger": "<string>",
"borderRadius": "0.5rem",
"fontFamily": "\"Inter var\", ui-sans-serif, system-ui, sans-serif"
}
},
"custom_css": "<string>"
}{
"error": {
"code": "forbidden",
"message": "your role does not allow this action"
}
}{
"error": {
"code": "forbidden",
"message": "your role does not allow this action"
}
}{
"error": {
"code": "forbidden",
"message": "your role does not allow this action"
}
}{
"error": {
"code": "forbidden",
"message": "your role does not allow this action"
}
}Set this environment's branding
Requires org:update. Replaces the palette: send the whole record, not a patch. A token you omit is a token you cleared — with a merge there would be no way to say “back to the default”, because an absent key and an emptied one would be the same request.
An unknown token is refused by name, with the list of the ones that exist. A value quietly dropped is worse than a refusal: you would edit the same field twice and conclude the feature is broken.
A token’s value is one CSS value and may not contain ;, {, }, <, > or a backslash — those are how a value stops being one. logo_url must be an absolute http(s) URL.
custom_css is optional, and omitting it leaves whatever is stored — the palette and the stylesheet are two screens, and a palette save must not wipe a stylesheet nobody was editing. It is served only over a custom domain you have verified: it never appears on the public config document, because arbitrary CSS on a shared host is a page that can be repainted as anybody’s product.
A valid request URL is required to generate request examples{
"logo_url": "<string>",
"tokens": {
"light": {
"colorPrimary": "#4f46e5",
"colorPrimaryText": "<string>",
"colorText": "<string>",
"colorMuted": "<string>",
"colorBackground": "<string>",
"colorBorder": "<string>",
"colorDanger": "<string>",
"borderRadius": "0.5rem",
"fontFamily": "\"Inter var\", ui-sans-serif, system-ui, sans-serif"
},
"dark": {
"colorPrimary": "#4f46e5",
"colorPrimaryText": "<string>",
"colorText": "<string>",
"colorMuted": "<string>",
"colorBackground": "<string>",
"colorBorder": "<string>",
"colorDanger": "<string>",
"borderRadius": "0.5rem",
"fontFamily": "\"Inter var\", ui-sans-serif, system-ui, sans-serif"
}
},
"custom_css": "<string>"
}{
"error": {
"code": "forbidden",
"message": "your role does not allow this action"
}
}{
"error": {
"code": "forbidden",
"message": "your role does not allow this action"
}
}{
"error": {
"code": "forbidden",
"message": "your role does not allow this action"
}
}{
"error": {
"code": "forbidden",
"message": "your role does not allow this action"
}
}Authorizations
A staff session token, uk_st_…. Minted by sign-up, sign-in or the two-factor exchange. Only a 401 means it is spent; not_a_member (403) is about the organization named in X-Organization-Id and leaves the token good for the others.
Headers
The organization the caller is acting on — the org_… code that appears in the panel URL. It identifies; the membership JOIN is what authorizes, so a forged code reads nothing: the answer is not_a_member (403), which does not mean the session is over. Absent, the session's default organization answers, or — if that membership was revoked while the session was open — any other one the caller still holds.
Path Parameters
The environment's id.
Body
An absolute http(s) URL, or empty for no logo.
"https://cdn.example.com/logo.svg"
The design tokens the drop-in components render with, one set per theme. Both themes are always present in a response, even empty — an empty set is the honest spelling of "your own defaults", and a client that had to handle dark being absent would be a client whose dark palette works depending on whether anybody ever set one.
The keys are exactly the ones appearance.variables takes in @userkit/react, so a token set in the panel and one passed as a prop name the same thing. A key outside this list is refused by name.
Show child attributes
Show child attributes
Omit to leave the stored stylesheet alone. May not contain </. Served only over a verified custom domain.
Response
Saved.
How one environment's screens look. Per environment on purpose: a palette can be tried in test while the live one stays untouched.
An absolute http(s) URL, or empty. It ends up in an <img src> on a page your customers read, which is why nothing else is accepted.
The design tokens the drop-in components render with, one set per theme. Both themes are always present in a response, even empty — an empty set is the honest spelling of "your own defaults", and a client that had to handle dark being absent would be a client whose dark palette works depending on whether anybody ever set one.
The keys are exactly the ones appearance.variables takes in @userkit/react, so a token set in the panel and one passed as a prop name the same thing. A key outside this list is refused by name.
Show child attributes
Show child attributes
Your own stylesheet. Present on this staff read so the editor can show what you wrote, and served to a browser only over a custom domain you have verified.