Update the access pages with PUT

PUT/branding/access-pages

branding:write replace_branding_access_pagesDestructiveIdempotentDeprecatedSunset 2027-06-30

Behaves exactly like PATCH /branding sent with only access_pages, whose fields are the body here without the wrapper: it applies a partial update like PATCH /branding (fields left out are kept), and returns both groups. It takes Idempotency-Key. Deprecated: withdrawn on 2027-06-30. Use PATCH /branding. Only a super admin can write, else 403 missing_permission. dry_run shows the result without saving it. It emits the same branding.updated webhook as PATCH, and sending the earlier values undoes it.

Query parameters

dry_runboolean#
Validate and run the call without committing it, returning what the real call would return with meta.dry_run set.

Request body

application/json, required · BrandingAccessPagesUpdate

alignstring#
Which side of the page the login form sits on: LEFT, MIDDLE (centred) or RIGHT.
One of: LEFT, MIDDLE, RIGHT
password_visibility_enabledboolean#
Whether the login form lets a user reveal the password they type.
display_sign_up_linkboolean#
Whether the login page links to the sign-up page.
login_titlestring | null#
The heading on the login page, up to 20 characters.
login_descriptionstring | null#
The text under the heading on the login page, up to 255 characters.
terms_and_conditions_titlestring | null#
The label of the terms and conditions link, up to 40 characters.
terms_and_conditionsstring | null#
The terms and conditions, as HTML, with no length limit.
privacy_policy_titlestring | null#
The label of the privacy policy link, up to 40 characters.
privacy_policystring | null#
The privacy policy, as HTML, with no length limit.
logonull#
Send null to remove the image. A stored image is set only with POST /branding/images, so any other value is 422.
background_imagenull#
Send null to remove the image. A stored image is set only with POST /branding/images, so any other value is 422.
mobile_light_logonull#
Send null to remove the image. A stored image is set only with POST /branding/images, so any other value is 422.
mobile_dark_logonull#
Send null to remove the image. A stored image is set only with POST /branding/images, so any other value is 422.

{
  "login_title": "Welcome back",
  "align": "MIDDLE"
}

Responses

200

The branding settings after the change.

Branding

{
  "data": {
    "access_pages": {
      "align": "LEFT",
      "password_visibility_enabled": true,
      "display_sign_up_link": true,
      "login_title": "string",
      "login_description": "string",
      "terms_and_conditions_title": "string",
      "terms_and_conditions": "string",
      "privacy_policy_title": "string",
      "privacy_policy": "string",
      "logo": "string",
      "background_image": "string",
      "mobile_light_logo": "string",
      "mobile_dark_logo": "string"
    },
    "sign_up_page": {
      "header": "string",
      "sub_header": "string",
      "find_out_label": "string",
      "find_out_placeholder": "string",
      "find_out_mandatory": true,
      "confirmation_header": "string",
      "confirmation_message": "string",
      "logo": "string",
      "background_image": "string",
      "display_phone_number": true
    }
  }
}

401

Authentication failed. error.code is one of invalid_token, expired, revoked.

Error

403

Authorization failed. error.code is one of org_disabled, ip_blocked, missing_scope, scope_disabled, user_disabled.

Error

422

The request can't be processed (HTTP 422): validation_failed with one ErrorDetail per problem, or a code documented on the operation.

Error

429

Rate limit exceeded (error.code = rate_limited).

Error

Examples

curl -X PUT https://your-org-domain/kong/core/api/v2/branding/access-pages\
  -H "Authorization: Bearer $HELM_API_KEY"\
  -H "Content-Type: application/json"\
  -d '{
  "login_title": "Welcome back",
  "align": "MIDDLE"
}'