> This page is for API, version 2026-01-01 (Stable) (default).
> For other versions, use one of these documentation indexes:
> - 2026-01-01 (Stable) (default): https://developer.deel.com/api/stable/llms.txt

> For clean Markdown of any page, append .md to the page URL.
> For a complete documentation index, see https://developer.deel.com/llms.txt.
> For AI client integration (Claude Code, Cursor, etc.), connect to the MCP server at https://developer.deel.com/_mcp/server.

# Update GP employee app access for a legal entity

POST https://api.letsdeel.com/rest/legal-entities/{legal_entity_id}/settings
Content-Type: application/json

Controls whether employees under this legal entity can access the Deel employee app for self-service tasks such as viewing payslips and managing personal information. Use this endpoint after you have finished configuring a Global Payroll legal entity and its workforce and are ready to grant or revoke employee app access. Set value to "true" to allow employees to log in to the app, or "false" to block access — for example, during a compliance review or when offboarding a cohort.

 **Token scopes**: `legal-entity:write`

Reference: https://developer.deel.com/api/reference/endpoints/legal-entities/update-legal-entity-setting-v-2026-09-02

## Authentication

- `Authorization` header (bearer token, required) — ## Authentication The Deel API uses bearer tokens to authenticate requests. All API calls must be made over HTTPS — calls over plain HTTP or without authentication will fail. ```curl curl -X GET 'https://api.letsdeel.com/rest/v2/contracts' \ -H 'Authorization: Bearer YOUR-TOKEN-HERE' ``` [Learn more about authentication](/api/authentication)
- `Authorization` header (bearer token, required) — Standard OAuth2 security scheme based on https://swagger.io/docs/specification/authentication/

## Servers

- `https://api.letsdeel.com/rest` (Production, default)
- `https://api-staging.letsdeel.com/rest` (Demo)

## Request

### Path parameters

- `legal_entity_id` (string, required) — The ID of the legal entity.

### Body (application/json)

This endpoint expects an object.

- `data` (LegalEntitiesLegalEntityIdSettingsPostRequestBodyContentApplicationJsonSchemaData, required)

## Response

### 200

Successfully updated the setting.

- `data` (LegalEntitiesLegalEntityIdSettingsPostResponsesContentApplicationJsonSchemaData, optional)

## Errors

### 400 Bad Request Error

Invalid request parameters.

- `message` (string, optional) — Error message explaining what went wrong.

### 401 Unauthorized Error

Operation failed.

- `request` (ApiErrorRequest, optional)
- `errors` (list of ApiError, optional)

### 403 Forbidden Error

Operation failed.

- `request` (ApiErrorRequest, optional)
- `errors` (list of ApiError, optional)

### 404 Not Found Error

Operation failed.

- `request` (ApiErrorRequest, optional)
- `errors` (list of ApiError, optional)

### 500 Internal Server Error

Operation failed.

- `request` (ApiErrorRequest, optional)
- `errors` (list of ApiError, optional)

## Types

### LegalEntitiesLegalEntityIdSettingsPostRequestBodyContentApplicationJsonSchemaData

- `key` (enum, required) — The setting key to update. Only ALLOW_GP_EMPLOYEE_APP_ACCESS is supported today.
  - Allowed values: `ALLOW_GP_EMPLOYEE_APP_ACCESS`
- `value` (enum, required) — Set to "true" to grant employees access to the Deel app, or "false" to revoke it.
  - Allowed values: `true`, `false`

### LegalEntitiesLegalEntityIdSettingsPostResponsesContentApplicationJsonSchemaData

- `key` (string, optional) — The setting key that was updated.
- `value` (string, optional) — The setting value that was applied.

### ApiErrorRequest

- `method` (string, optional) — The HTTP method of the failed request
- `url` (string, optional) — The relative URL of the failed request
- `status` (double, optional) — The status code of the response
- `api_req_id` (string, optional) — The request ID of the failed request
- `docs` (string, optional) — A link to the official documentation for the requested endpoint resource
- `source` (string, optional) — The source handler which produced the returned error
- `code` (double, optional) — The code of the source handler which produced the returned error

### ApiError

- `message` (string, optional) — A description of the returned error
- `path` (string, optional) — The JSON path where input validation failed

## Examples

**Request**

```json
{
  "data": {
    "key": "ALLOW_GP_EMPLOYEE_APP_ACCESS",
    "value": "true"
  }
}
```

**Response**

```json
{
  "data": {
    "key": "ALLOW_GP_EMPLOYEE_APP_ACCESS",
    "value": "true"
  }
}
```

**SDK Code**

```python
import requests

url = "https://api.letsdeel.com/rest/legal-entities/123e4567-e89b-12d3-a456-426614174000/settings"

payload = { "data": {
        "key": "ALLOW_GP_EMPLOYEE_APP_ACCESS",
        "value": "true"
    } }
headers = {
    "Authorization": "Bearer <token>",
    "Content-Type": "application/json"
}

response = requests.post(url, json=payload, headers=headers)

print(response.json())
```

```javascript
const url = 'https://api.letsdeel.com/rest/legal-entities/123e4567-e89b-12d3-a456-426614174000/settings';
const options = {
  method: 'POST',
  headers: {Authorization: 'Bearer <token>', 'Content-Type': 'application/json'},
  body: '{"data":{"key":"ALLOW_GP_EMPLOYEE_APP_ACCESS","value":"true"}}'
};

try {
  const response = await fetch(url, options);
  const data = await response.json();
  console.log(data);
} catch (error) {
  console.error(error);
}
```

```go
package main

import (
	"fmt"
	"strings"
	"net/http"
	"io"
)

func main() {

	url := "https://api.letsdeel.com/rest/legal-entities/123e4567-e89b-12d3-a456-426614174000/settings"

	payload := strings.NewReader("{\n  \"data\": {\n    \"key\": \"ALLOW_GP_EMPLOYEE_APP_ACCESS\",\n    \"value\": \"true\"\n  }\n}")

	req, _ := http.NewRequest("POST", url, payload)

	req.Header.Add("Authorization", "Bearer <token>")
	req.Header.Add("Content-Type", "application/json")

	res, _ := http.DefaultClient.Do(req)

	defer res.Body.Close()
	body, _ := io.ReadAll(res.Body)

	fmt.Println(res)
	fmt.Println(string(body))

}
```

```ruby
require 'uri'
require 'net/http'

url = URI("https://api.letsdeel.com/rest/legal-entities/123e4567-e89b-12d3-a456-426614174000/settings")

http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true

request = Net::HTTP::Post.new(url)
request["Authorization"] = 'Bearer <token>'
request["Content-Type"] = 'application/json'
request.body = "{\n  \"data\": {\n    \"key\": \"ALLOW_GP_EMPLOYEE_APP_ACCESS\",\n    \"value\": \"true\"\n  }\n}"

response = http.request(request)
puts response.read_body
```

```java
import com.mashape.unirest.http.HttpResponse;
import com.mashape.unirest.http.Unirest;

HttpResponse<String> response = Unirest.post("https://api.letsdeel.com/rest/legal-entities/123e4567-e89b-12d3-a456-426614174000/settings")
  .header("Authorization", "Bearer <token>")
  .header("Content-Type", "application/json")
  .body("{\n  \"data\": {\n    \"key\": \"ALLOW_GP_EMPLOYEE_APP_ACCESS\",\n    \"value\": \"true\"\n  }\n}")
  .asString();
```

```php
<?php
require_once('vendor/autoload.php');

$client = new \GuzzleHttp\Client();

$response = $client->request('POST', 'https://api.letsdeel.com/rest/legal-entities/123e4567-e89b-12d3-a456-426614174000/settings', [
  'body' => '{
  "data": {
    "key": "ALLOW_GP_EMPLOYEE_APP_ACCESS",
    "value": "true"
  }
}',
  'headers' => [
    'Authorization' => 'Bearer <token>',
    'Content-Type' => 'application/json',
  ],
]);

echo $response->getBody();
```

```csharp
using RestSharp;

var client = new RestClient("https://api.letsdeel.com/rest/legal-entities/123e4567-e89b-12d3-a456-426614174000/settings");
var request = new RestRequest(Method.POST);
request.AddHeader("Authorization", "Bearer <token>");
request.AddHeader("Content-Type", "application/json");
request.AddParameter("application/json", "{\n  \"data\": {\n    \"key\": \"ALLOW_GP_EMPLOYEE_APP_ACCESS\",\n    \"value\": \"true\"\n  }\n}", ParameterType.RequestBody);
IRestResponse response = client.Execute(request);
```

```swift
import Foundation

let headers = [
  "Authorization": "Bearer <token>",
  "Content-Type": "application/json"
]
let parameters = ["data": [
    "key": "ALLOW_GP_EMPLOYEE_APP_ACCESS",
    "value": "true"
  ]] as [String : Any]

let postData = JSONSerialization.data(withJSONObject: parameters, options: [])

let request = NSMutableURLRequest(url: NSURL(string: "https://api.letsdeel.com/rest/legal-entities/123e4567-e89b-12d3-a456-426614174000/settings")! as URL,
                                        cachePolicy: .useProtocolCachePolicy,
                                    timeoutInterval: 10.0)
request.httpMethod = "POST"
request.allHTTPHeaderFields = headers
request.httpBody = postData as Data

let session = URLSession.shared
let dataTask = session.dataTask(with: request as URLRequest, completionHandler: { (data, response, error) -> Void in
  if (error != nil) {
    print(error as Any)
  } else {
    let httpResponse = response as? HTTPURLResponse
    print(httpResponse)
  }
})

dataTask.resume()
```