> ## Documentation Index > Fetch the complete documentation index at: https://docs.tallychannel.com/llms.txt > Use this file to discover all available pages before exploring further. # Propose Update > Proposes a set of RFC 6902 patch operations against the subject's current state. The proposal is stored but not applied until the `apply` endpoint is called. Requires `tenant_proposer` role. The `base_snapshot_version` must match the subject's current latest version — stale proposals are rejected with 409. ## OpenAPI ````yaml POST /v1/tenants/{tenant_id}/subjects/{subject_type}/{subject_id}/updates openapi: 3.1.0 info: title: Tally Platform API version: '1.0' description: > The Tally Platform API is a versioned REST API for managing business identity state, counterparty access grants, and refresh workflows. All tenant-scoped endpoints require an `Authorization: Bearer ` header containing a valid Firebase Auth JWT. Tokens are issued by Google Identity Platform (GCIP) after sign-in at your environment's app domain. **Base URLs** | Environment | URL | |-------------|-----| | Staging | `https://tally-platform-api-xwka6vu2kq-ue.a.run.app` | | Production | `https://tally-platform-api-iikaevm4pq-ue.a.run.app` | contact: email: support@tallychannel.com servers: - url: https://tally-platform-api-xwka6vu2kq-ue.a.run.app description: Staging - url: https://tally-platform-api-iikaevm4pq-ue.a.run.app description: Production security: - BearerAuth: [] tags: - name: System description: Health checks and service metadata. No authentication required. - name: Tenants description: Tenant creation and member management. - name: Grants description: >- Access grant lifecycle — create, list, revoke. Controls which counterparty tenants can read which subjects. - name: Identity State description: >- Initial snapshot creation. Writes the first versioned state record for a subject. - name: Snapshots description: >- Read identity state — latest, history, by ID, export, chain proof, and diff. - name: Updates description: Propose and apply RFC 6902 patch updates to create new snapshot versions. - name: Transfer Offers description: Consensual `tenant_owner` role transfer handshake between principals. - name: Refresh Requests description: >- Counterparty-initiated requests for attribute updates or snapshot confirmation. - name: Webhooks description: Webhook subscription management and secret rotation. paths: /v1/tenants/{tenant_id}/subjects/{subject_type}/{subject_id}/updates: post: tags: - Updates summary: Propose an identity state update description: > Proposes a set of RFC 6902 patch operations against the subject's current state. The proposal is stored but not applied until the `apply` endpoint is called. Requires `tenant_proposer` role. The `base_snapshot_version` must match the subject's current latest version — stale proposals are rejected with 409. operationId: proposeUpdate parameters: - $ref: '#/components/parameters/tenant_id' - $ref: '#/components/parameters/subject_type' - $ref: '#/components/parameters/subject_id' requestBody: required: true content: application/json: schema: type: object properties: subject_id: type: string subject_type: type: string enum: - individual - organization base_snapshot_version: type: integer description: >- The version this patch is based on. Must be the current latest. patch_ops: type: array description: >- RFC 6902 JSON Patch operations. Only `add`, `replace`, and `remove` are supported. items: type: object properties: op: type: string enum: - add - replace - remove path: type: string description: JSON Pointer to the target field. value: {} required: - op - path required: - subject_id - subject_type - base_snapshot_version - patch_ops responses: '201': description: Update proposal created. content: application/json: schema: type: object properties: update_id: type: string format: uuid subject_type: type: string subject_id: type: string base_snapshot_version: type: integer status: type: string enum: - proposed created_at: type: string format: date-time '400': $ref: '#/components/responses/ValidationError' '401': $ref: '#/components/responses/Unauthorized' '403': $ref: '#/components/responses/Forbidden' '409': description: >- Base version is stale — another update has been applied since this proposal was based. content: application/json: schema: $ref: '#/components/schemas/ErrorEnvelope' components: parameters: tenant_id: name: tenant_id in: path required: true schema: type: string description: Tenant identifier. example: tally-staging subject_type: name: subject_type in: path required: true schema: type: string enum: - individual - organization description: Subject type discriminator. subject_id: name: subject_id in: path required: true schema: type: string description: Stable subject identifier within its type namespace. example: subj-f71e30bc responses: ValidationError: description: Request body or parameter failed validation. content: application/json: schema: $ref: '#/components/schemas/ErrorEnvelope' example: error: code: validation_error message: Request body failed schema validation. details: - path: /subject_id message: subject_id is required. Unauthorized: description: Missing or invalid Bearer token. content: application/json: schema: $ref: '#/components/schemas/ErrorEnvelope' example: error: code: unauthorized message: Authentication required. Forbidden: description: Authenticated but insufficient role or missing grant. content: application/json: schema: $ref: '#/components/schemas/ErrorEnvelope' example: error: code: forbidden message: Owner or grant required. schemas: ErrorEnvelope: type: object properties: error: type: object properties: code: type: string description: Machine-readable error code. example: validation_error message: type: string description: Human-readable error message. example: Request body failed schema validation. details: type: array items: $ref: '#/components/schemas/ErrorDetail' request_id: type: string description: Request ID for tracing. Injected server-side. example: req_01j2k3m4n5 required: - code - message required: - error ErrorDetail: type: object properties: path: type: string description: JSON Pointer to the field that caused the error. example: /subject_id message: type: string example: subject_id is required. code: type: string example: invalid_type required: - path - message securitySchemes: BearerAuth: type: http scheme: bearer bearerFormat: JWT description: | Firebase Auth JWT issued by Google Identity Platform. Obtain a token by signing in at your app domain and calling `firebase.auth().currentUser.getIdToken()`. ````