# Update booking membership restrictions

`PUT /api/configuration/bookings/restrictions/memberships/{id}`

- **Products:** Operator (`FOH`)
- **Features:** Front of House Generic Access (`FOHGENERIC`)

HTML version: [Update booking membership restrictions](https://support.gladstonesoftware.cloud/reference/configuration/update-booking-membership-restrictions)

## Overview

Rewrites one booking membership restriction. A restriction pairs a set of activities with a set of
membership types, so that those activities can only be booked by members holding one of those
membership types. Both sides of the pairing, and the restriction's description, are set by this
call.

**This is a full replacement of all three parts, not a partial update.** The activity list and the
membership type list are each deleted and rebuilt from the arrays you send, and the description is
overwritten. There is no way to add a single activity or membership type — read the restriction
first and send the complete intended state.

All three fields are effectively mandatory even though they are not marked as required: the endpoint rejects a blank `description`, an empty or missing `activities` array and an
empty or missing `memberships` array, each with its own `400`. This means **you cannot use this
endpoint to remove all restricted activities or all permitted membership types** — delete the
restriction instead.

**The update is not atomic.** Changes are saved in three separate steps, in this order: the activity
list, the membership type list, then the description. Validation of the whole request happens before
any of them, so a bad request changes nothing, but a server-side failure part-way through can leave the
restriction with the new activities and the old membership types. If a call returns `500`, re-read
the restriction before retrying.

The restriction must already exist; an unknown id returns `404`. The restriction is saved with only its id and
description, so nothing else on the existing restriction — including its audit stamps — is carried over.

On success the response is `204 No Content`.

## Endpoint

`PUT {base_url}/api/configuration/bookings/restrictions/memberships/{id}`

`{base_url}` is the environment URL issued to your integration. See [Authenticating with Gladstone APIs](../../guides/authenticating-with-gladstone-apis.md).

## Path parameters

| Name | Type | Required | Description |
|------|------|----------|-------------|
| `id` | integer (int32) | Yes | Numeric identifier of the restriction to rewrite, as returned when the restriction was created or listed. If no restriction has this id the request fails with `404 No booking membership restriction exists against ID {id}.` — checked before the body is validated. |

## Request body

| Field | Type | Required | Description |
|-------|------|----------|-------------|
| `description` | string | Yes | Label identifying what this restriction is for, used when restrictions are listed for administration. Mandatory in practice: null, empty or whitespace is rejected with `400 No description provided.` — so it cannot be cleared, and it is overwritten on every call. |
| `activities` | array of string | Yes | The complete set of activity identifiers this restriction applies to — the activities that become bookable only by the membership types in `memberships`. Every id must already exist as an activity, or the request fails with `400 No activities found for the following activity Ids: {ids}.`, naming each one it could not find. Mandatory in practice: missing, null or empty is rejected with `400 No booking membership restrictions activity ids provided.`. The existing activity list is deleted and rebuilt from this array, so send every activity the restriction should cover, not just the new ones. |
| `memberships` | array of string | Yes | The complete set of membership type identifiers allowed to book the activities in `activities`. Every id must already exist as a membership type, or the request fails with `400 No membership types found for the following membership type Ids: {ids}.`, naming each one it could not find. Mandatory in practice: missing, null or empty is rejected with `400 No booking membership restrictions membership type ids provided.`. Like `activities`, the stored list is deleted and rebuilt from this array. |

## Sample request

```bash title="cURL"
curl -X PUT '{base_url}/api/configuration/bookings/restrictions/memberships/{id}' \
  -H 'Authorization: Bearer {accessToken}' \
  -H 'X-Use-SSO: true' \
  -H 'Content-Type: application/json' \
  -d '{
  "description": "string",
  "activities": [
    "string"
  ],
  "memberships": [
    "string"
  ]
}'
```

## Errors

| Status | Meaning | When |
|--------|---------|------|
| `400` | Bad request | No body was sent — `No booking membership restrictions provided.` |
| `400` | Bad request | `description` is missing, empty or whitespace — `No description provided.` |
| `400` | Bad request | `activities` is missing, null or empty — `No booking membership restrictions activity ids provided.` |
| `400` | Bad request | `memberships` is missing, null or empty — `No booking membership restrictions membership type ids provided.` |
| `400` | Bad request | One or more activity ids do not exist — `No activities found for the following activity Ids: {ids}.` The offending ids are listed, comma separated; nothing is written. |
| `400` | Bad request | One or more membership type ids do not exist — `No membership types found for the following membership type Ids: {ids}.` The offending ids are listed, comma separated; nothing is written. |
| `404` | Not found | No restriction exists for the path id — `No booking membership restriction exists against ID {id}.` This is checked before any body validation, so an unknown id masks any problem with the body. |
| `500` | Internal server error | An unexpected server-side failure. Because the three writes are separate saves, a failure here can leave the restriction partly updated; re-read it before retrying. No detail is returned. |