> ## Documentation Index > Fetch the complete documentation index at: https://docs.yativo.com/llms.txt > Use this file to discover all available pages before exploring further. # Update Employee > Update an employee's details or status ## OpenAPI ````yaml openapi-fiat.yaml PUT /corporate-card/employees/{employee_id} openapi: 3.0.3 info: title: Yativo Fiat API description: > The Yativo Fiat API enables businesses to manage customers, run KYC/KYB, send and receive cross-border payments, issue virtual accounts and virtual cards, manage beneficiaries, and more. **Base URLs** | Environment | URL | |---|---| | Production | `https://api.yativo.com/api/v1` | | Sandbox | `https://smtp.yativo.com/api/v1` | **Authentication** Send `X-Api-Key` and `X-Api-Secret` on every request. Create keys in the dashboard under **Developers → API Keys**. Each key only works from the server IPs listed on it (enforced since 14 October 2026). Keys don't expire and there's no login call or token refresh. Login tokens (`POST /auth/login` with an Account ID and App Secret, and `Authorization: Bearer`) have been discontinued and don't work for API requests. Endpoints that change how a person signs in (passkeys, two-factor authentication, PIN) or delete the account can't be called with an API key. Use the dashboard for those. API keys and IP whitelists can only be managed in the dashboard. **Rate limits** Per business account: 20 writes (`POST`, `PUT`, `PATCH`, `DELETE`) and 50 reads (`GET`) a second. Some plans set their own limit. Enterprise plans have no general limit. **Idempotency** Send an `Idempotency-Key` header on every `POST`, `PUT`, `PATCH` and `DELETE` request. A retry with the same key and body within 60 minutes returns the original response without running again. Reusing a key with a different body returns `409`. **KYC endpoints** are hosted on a separate platform at `https://kyc.yativo.com`. They are documented here for completeness but use that base URL, not the main API base. version: 1.0.0 contact: name: Yativo Support url: https://yativo.com servers: - url: https://api.yativo.com/api/v1 description: Production - url: https://smtp.yativo.com/api/v1 description: Sandbox security: - apiKey: [] apiSecret: [] tags: - name: Customers description: Create and manage customer profiles. - name: KYC / KYB description: > Identity verification for individual customers (KYC) and business customers (KYB). Submission endpoints are on `https://kyc.yativo.com/api`. - name: KYC Lookups description: > Lists your KYC and KYB forms need: countries, subdivisions, postal code formats, ID types, occupations, industries and allowed values. Served from `https://kyc.yativo.com/api`. - name: Payments & Transfers description: Exchange rates, quotes, send money, payout methods, and wallet payouts. - name: Deposits description: Initiate and retrieve payin deposits. - name: Virtual Accounts description: Issue and manage virtual bank accounts for customers. - name: Wallets description: View balances, create wallets, and list wallet payouts. - name: Beneficiaries description: >- Save recipients' account details as beneficiaries and reuse them in payouts. - name: Transactions description: List, retrieve, track, and download receipts for all transaction types. - name: Virtual Cards description: >- Activate, issue, manage, and terminate prepaid virtual cards. Every card request works only on your own cards. Any other card ID returns `404` with `Card not found`. - name: Payouts description: Single payouts to beneficiaries. - name: Currency Swap description: Swap balance between your own currency wallets. - name: IP Whitelist description: Check whether your server's IP can use your API key. - name: Corporate Cards description: >- Employees, their KYC, cards, card balances, memos and the USDC funding address. By invitation only. - name: Corporate Card Transactions description: Card activity on your corporate cards, with disputes, notes and invoices. - name: Corporate Card Links description: >- Each corporate card's employee-only page for card details and PIN, employee card sign-in, and branding. - name: Webhooks description: Register and manage webhook endpoints for real-time event notifications. - name: Developer description: Webhook event inspection. paths: /corporate-card/employees/{employee_id}: put: tags: - Corporate Cards summary: Update Employee description: >- Updates the fields you send. Set `status` to `suspended` to block every corporate card request for the employee with `403`, and back to `active` to restore access. Once an employee has confirmed their email on a [card link](/yativo-fiat/corporate-card-links), a new `email` isn't applied straight away. The employee gets a code at their current address and confirms the change on their card link. The response then includes `email_change` with `status: "pending_confirmation"`. That email can't be removed, only changed. Corporate cards are available by invitation only. Without one, this request returns `403`. See [Corporate Cards in Sandbox](/yativo-fiat/sandbox-corporate-cards). parameters: - name: employee_id in: path required: true schema: type: string description: The employee's `employee_id`. requestBody: required: true content: application/json: schema: type: object properties: full_name: type: string maxLength: 191 email: type: string format: email dob: type: string format: date occupation: type: string maxLength: 191 status: type: string description: '`active`, `suspended` or `terminated`.' enum: - active - suspended - terminated metadata: type: object additionalProperties: true selfie_image: type: string description: File or base64 data URI. jpeg, png or webp, up to 10 MB. format: binary selfie_image_url: type: string multipart/form-data: schema: type: object properties: full_name: type: string maxLength: 191 email: type: string format: email dob: type: string format: date occupation: type: string maxLength: 191 status: type: string description: '`active`, `suspended` or `terminated`.' enum: - active - suspended - terminated metadata: type: object additionalProperties: true selfie_image: type: string description: File or base64 data URI. jpeg, png or webp, up to 10 MB. format: binary selfie_image_url: type: string responses: '200': description: Request successful content: application/json: schema: type: object properties: status: type: string example: success status_code: type: integer example: 200 message: type: string example: Request successful data: allOf: - $ref: '#/components/schemas/Employee' - type: object properties: email_change: type: object description: >- Only when an email change is waiting for the employee to confirm it. properties: status: type: string example: pending_confirmation pending_email: type: string '403': description: >- Corporate cards aren't enabled on your account, the customer has no approved `cobo_pobo` endorsement or full KYC, or the employee is suspended or terminated content: application/json: schema: $ref: '#/components/schemas/ErrorResponse' '404': description: The `customer_id`, `employee_id` or `card_id` isn't yours content: application/json: schema: $ref: '#/components/schemas/ErrorResponse' '422': description: Validation error content: application/json: schema: $ref: '#/components/schemas/ErrorResponse' '429': description: Too many email change codes requested. Wait and retry content: application/json: schema: $ref: '#/components/schemas/ErrorResponse' '502': description: The selfie upload failed. Nothing was saved, so retry content: application/json: schema: $ref: '#/components/schemas/ErrorResponse' components: schemas: Employee: type: object properties: employee_id: type: string example: emp_456 customer_id: type: string example: cus_123 full_name: type: string example: Jane Doe email: type: string nullable: true example: jane@example.com dob: type: string nullable: true format: date example: '1990-04-12' occupation: type: string nullable: true example: Operations Manager status: type: string description: '`active`, `suspended` or `terminated`.' enum: - active - suspended - terminated kyc_status: type: string description: '`not_started`, `submitted`, `approved` or `rejected`.' enum: - not_started - submitted - approved - rejected kyc_reject_reason: type: string nullable: true metadata: type: object nullable: true additionalProperties: true example: department: Finance selfie_image: type: string nullable: true created_at: type: string format: date-time updated_at: type: string format: date-time ErrorResponse: type: object properties: status: type: string example: failed status_code: type: integer message: type: string example: Request failed. data: type: object nullable: true properties: error: type: string error_details: $ref: '#/components/schemas/ErrorDetails' ErrorDetails: type: object description: >- Included on every failed response, with the same shape for every endpoint. properties: code: type: string enum: - bad_request - unauthenticated - payment_required - forbidden - not_found - method_not_allowed - conflict - validation_error - rate_limited - server_error - not_implemented - upstream_error - service_unavailable - upstream_timeout example: validation_error message: type: string example: The amount field is required. http_status: type: integer example: 422 fields: type: object description: >- Messages per field. When the error isn't about a field, the message is under `error`. additionalProperties: type: array items: type: string retryable: type: boolean description: '`true` for 409, 429, 500, 502, 503 and 504.' example: false retry_after: type: integer nullable: true description: Seconds to wait before retrying, from the `Retry-After` header. securitySchemes: apiKey: type: apiKey in: header name: X-Api-Key description: >- Your API key (`yativo_pk_...`) from Developers → API Keys. Send together with X-Api-Secret. apiSecret: type: apiKey in: header name: X-Api-Secret description: Your API secret (`yativo_sk_...`), shown once when the key is created. ```` This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.