PATCH /school/settings updates only the settings you want to change. Send a JSON object with Content-Type: application/json; do not wrap it in data.
Use PATCH, not POST. The response contains the complete resulting settings in data and actual changes in meta.updatedFields.

Authentication and permissions

Send a school-scoped API key or an OAuth access token as Authorization: Bearer YOUR_CREDENTIAL.
These are school-facing endpoints. Partners must use the school-scoped key created for that school; a partner credential alone is not accepted.

The credential determines the school. Never send a school identifier in the path, query, headers or JSON body.

A school key with ACL_SCHOOL = 3 can use both methods. ACL_SCHOOL = 1 can only read; ACL_SCHOOL = 2 can only update.
A read-only OAuth user cannot PATCH, even with the write scope.
The school's existing subscription and API-access requirements also apply.

Partial updates: omitted values stay unchanged

• Every field is optional, but you must provide at least one writable field.
• Omitted fields stay unchanged. Sending half the settings leaves the other half untouched.
• Nested objects merge property by property. Sending customAttendanceSheet.header preserves customAttendanceSheet.footer.
• false, 0 and valid empty strings are real values and are applied.
• Unknown fields and empty nested objects are rejected with 400.
• All requested changes succeed together or none are saved. Validation or permission failures do not partially update settings.
• Unchanged values are skipped. A valid request that changes nothing returns 200 with an empty updatedFields array.
• updatedFields uses top-level API names. Changing customAttendanceSheet.header reports customAttendanceSheet once.

Clearing values

Text settings are trimmed; language codes must match exactly. Emails must be valid; emailForLists and emailSendInvoices accept comma-separated addresses.
language accepts fr, en, it or es. timezone must be a named IANA zone such as Europe/Paris or UTC.
Field descriptions below explain length limits, numeric bounds and units. In particular, delayToSendJustifyAbsence is a justification submission limit in days; survey reminder delay is in seconds.

Header and footer formatting

customAttendanceSheet.header and footer accept plain text or safe formatting HTML in JSON strings.
For example:

{"customAttendanceSheet":{"header":"<p><strong>Training centre</strong><br />Attendance record</p>"}}

Supported tags: p, br, div, span, strong, b, em, i, u, s, ul, ol, li, blockquote, h1-h6, table, thead, tbody, tfoot, tr, th and td.
All attributes are rejected, including style, class, id and event handlers. Unsupported tags such as script, img, a, iframe, style, svg and math are rejected with 400; no part of that PATCH is saved.
Allowed HTML is normalized before storage: tag names become lowercase, line breaks use <br />, text entities are escaped, and comments are removed. For example, R&D is stored as R&D and still displays as R&D. The response contains the normalized string; resending equivalent HTML does not count as a change.
Each accepts at most 10000 characters including markup, both before and after normalization; an empty string clears it. The existing school customization option controls whether this content appears on PDFs. Existing stored content and omitted header/footer values are left unchanged.

Read-only settings and naming restrictions

The response includes four settings that PATCH cannot update:

• professorSignatureReminder
• automaticResendSignEmails
• reminderDelay
• sendExplanationEmailProfessor

Edit these reminder settings through the school UI. Including any of them in PATCH returns 400, even when the value is unchanged.
Do not send the whole GET response back as a PATCH body: remove read-only fields and the data envelope.

Schools with a branded app must also change their name through the school UI. An unchanged name is accepted; a changed name rejects the entire PATCH.
Other settings can still be updated for these schools.

Examples

Start with the one-field or partial-update examples. The full writable example shows every accepted field for reference; sending all fields is never required.
The partial-update response example starts from the GET example and demonstrates false, zero, null and a nested header change with the footer preserved.

Errors

429 can originate before authentication or inside the API; both JSON shapes are documented below.
Error messages are deliberately generic and do not echo rejected input.