# PUT /v2/vat

Mehrwertsteuersatz aktualisieren

Aktualisiert die übergebenen Felder eines eigenen Mehrwertsteuersatzes und leert den Steuer-Cache. Der aktuelle Standardsatz darf nicht deaktiviert und sein Standardkennzeichen nicht entfernt werden. Ein neuer Standard aktiviert den Satz und entfernt andere Standards. Die ID wird im Pfad oder beim Basisendpunkt im äußeren id-Feld übergeben.

- Operation-ID: put_v2_vat
- Dokumentation: /docs/api/v2/operations/put-v2-vat-1e5d6c8a5849/
- OpenAPI-Version: 3.2.1
- Vollständige Spezifikation: /docs/api/v2/openapi.json
- Dokumentationsstatus: reviewed
- Ändert Zustand: ja
- Für Automation freigegeben: nein

## Server

Serverwerte stammen unverändert aus der Datei. Eine lokale Entwicklungsadresse ist keine bestätigte Produktionsadresse. `API_ORIGIN` muss auf die passende Instanz gesetzt werden.

```json
[
  {
    "url": "https://app2.edoobox.com",
    "description": "edoobox API"
  }
]
```

## Authentifizierung

Eine der folgenden Alternativen genügt (ODER). Innerhalb einer Alternative müssen alle Verfahren gemeinsam erfüllt sein (UND).

1. **bearerAuth** (HTTP bearer) — Existing edoobox v2 access token. Never substitute API key/secret headers. **UND** **accountContext** (header: edid) — Selected login/account context from the JWT, not a database primary key. Required even for a JWT with one account.
2. **sessionCookie** (cookie: _edlogin) — Existing browser login session, with the same permission checks as Bearer authentication. **UND** **accountContext** (header: edid) — Selected login/account context from the JWT, not a database primary key. Required even for a JWT with one account.

### Wirksame Security Requirements und vollständige Verfahren

```json
{
  "security": [
    {
      "bearerAuth": [],
      "accountContext": []
    },
    {
      "sessionCookie": [],
      "accountContext": []
    }
  ],
  "securitySchemes": {
    "bearerAuth": {
      "type": "http",
      "scheme": "bearer",
      "bearerFormat": "JWT",
      "description": "Existing edoobox v2 access token. Never substitute API key/secret headers."
    },
    "accountContext": {
      "type": "apiKey",
      "in": "header",
      "name": "edid",
      "description": "Selected login/account context from the JWT, not a database primary key. Required even for a JWT with one account."
    },
    "sessionCookie": {
      "type": "apiKey",
      "in": "cookie",
      "name": "_edlogin",
      "description": "Existing browser login session, with the same permission checks as Bearer authentication."
    }
  }
}
```

## Parameter

| Name | Ort | Pflicht | Beschreibung |
| --- | --- | --- | --- |
| language | header | nein | Account language code, where the resource supports setLanguage(). |
| X-Edoobox-If-Revision | header | nein | Optional account mutation revision from a preceding authenticated auth-context snapshot. The dispatcher compares it while holding the account lock; mismatch409 requires a new review. |

### Vollständige wirksame Parameterdefinitionen

```json
[
  {
    "name": "language",
    "in": "header",
    "required": false,
    "description": "Account language code, where the resource supports setLanguage().",
    "schema": {
      "type": "string",
      "examples": [
        "de"
      ]
    }
  },
  {
    "name": "X-Edoobox-If-Revision",
    "in": "header",
    "required": false,
    "schema": {
      "type": "string",
      "pattern": "^[a-f0-9]{32}$",
      "examples": [
        "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"
      ]
    },
    "description": "Optional account mutation revision from a preceding authenticated auth-context snapshot. The dispatcher compares it while holding the account lock; mismatch409 requires a new review."
  }
]
```

## Anfrage

```json
{
  "required": true,
  "content": {
    "application/json": {
      "schema": {
        "type": "object",
        "properties": {
          "data": {
            "type": "object",
            "properties": {
              "id": false,
              "status": {
                "description": "Canonical boolean. Native PUT derives activity from integer casts, not a rejecting boolean/0-or-1 input guard. Both field hooks use the same activity rule: nonzero default activates; otherwise supplied status selects active/inactive; otherwise current activity remains. The VAT must exist in this account before any default clear. Existing raw-truthiness validation still rejects unsetting/deactivating a current default or raw status=false with raw default=true. Thus status:false plus default:false deactivates a nondefault VAT in either JSON key order. POST uses its loose-truthiness getter and separate before-insert hook.",
                "x-edoobox-schemaStatus": "source-reviewed-normalization",
                "x-edoobox-canonicalType": "boolean",
                "examples": [
                  false,
                  true
                ],
                "x-edoobox-contractSource": [
                  {
                    "file": "application/models/v2/Vat.php",
                    "line": 38,
                    "reason": "Exact Structure declaration: get converts incoming wire input; set converts response output.",
                    "sha256": "e1cdb6c7a92dd3e1fe2fb08e96946d3a70502cbc1d12fa7b572eae1d170f0eef"
                  },
                  {
                    "file": "application/models/v2/Vat.php",
                    "line": 152,
                    "reason": "Exact POST/PUT callers use API_DATA and Modal Vat.",
                    "sha256": "e1cdb6c7a92dd3e1fe2fb08e96946d3a70502cbc1d12fa7b572eae1d170f0eef"
                  },
                  {
                    "file": "application/models/v2/API_DATA.php",
                    "line": 1278,
                    "reason": "Single POST injects absent insert_default as 0, executes incoming getters (not update func) and calls before-insert hook.",
                    "sha256": "c0e15d26a7a4f3fb3c25e35557d4420ad395b2af3925caec292de08e32ebf44c"
                  },
                  {
                    "file": "application/models/v2/API_DATA.php",
                    "line": 1792,
                    "reason": "PUT tests update flag then dispatches exact resource hook: true succeeds, array merges, false returns ED90100.",
                    "sha256": "c0e15d26a7a4f3fb3c25e35557d4420ad395b2af3925caec292de08e32ebf44c"
                  },
                  {
                    "file": "application/models/v2/Vatfunc.php",
                    "line": 31,
                    "reason": "Actual Vatfunc hook; Permissionfunc same-named method is not dispatched.",
                    "sha256": "3d8cef71f39ce3b4cc04f2adc95b8ee0f8d490983db2d55e1f6ec6445a2c63ee"
                  },
                  {
                    "file": "application/models/v2/Vatfunc.php",
                    "line": 40,
                    "reason": "POST before-insert default behavior; no update validation call.",
                    "sha256": "3d8cef71f39ce3b4cc04f2adc95b8ee0f8d490983db2d55e1f6ec6445a2c63ee"
                  },
                  {
                    "file": "application/models/v2/Vatfunc.php",
                    "line": 80,
                    "reason": "Raw-truthiness validation forbids removal/deactivation of current default and status=false with default=true.",
                    "sha256": "3d8cef71f39ce3b4cc04f2adc95b8ee0f8d490983db2d55e1f6ec6445a2c63ee"
                  },
                  {
                    "file": "docs/openapi/reviews/payment-fields.json",
                    "line": 1,
                    "reason": "Independent field-level source review, direction applicability, examples and explicit runtime limitations.",
                    "sha256": "4a3097e873943fa5090a2fd52086762dc36a50d399bdd78ad6b20e6ed595639a"
                  },
                  {
                    "file": "application/models/v2/Vatfunc.php",
                    "line": 58,
                    "lineEnd": 70,
                    "reason": "Every update resolves the VAT row by id and firma_info_id; missing or foreign rows throw ED80100 before default-clearing writes.",
                    "sha256": "3d8cef71f39ce3b4cc04f2adc95b8ee0f8d490983db2d55e1f6ec6445a2c63ee"
                  },
                  {
                    "file": "application/models/v2/Vatfunc.php",
                    "line": 72,
                    "lineEnd": 78,
                    "reason": "Both field hooks merge the same aktiv value: nonzero integer default activates; otherwise supplied integer status wins; otherwise existing activity remains. JSON key order cannot restore the old activity.",
                    "sha256": "3d8cef71f39ce3b4cc04f2adc95b8ee0f8d490983db2d55e1f6ec6445a2c63ee"
                  }
                ]
              },
              "description": {
                "x-edoobox-canonicalType": "string",
                "x-edoobox-maxStoredLength": 250,
                "x-edoobox-normalization": "The aP getter trims text, replaces newlines and limits the legacy escaped storage representation to maxStoredLength UTF-8 characters without splitting escape pairs; aQ decodes the stored representation. Non-string input becomes empty text. This getter limit is normalization, not a rejecting input maxLength or proof of a custom action hook or database column capacity.",
                "examples": [
                  "Example"
                ],
                "x-edoobox-requiredOnCreate": true,
                "x-edoobox-sourceLine": 49
              },
              "vat_number": {
                "x-edoobox-canonicalType": "string",
                "x-edoobox-maxStoredLength": 250,
                "x-edoobox-normalization": "The aP getter trims text, replaces newlines and limits the legacy escaped storage representation to maxStoredLength UTF-8 characters without splitting escape pairs; aQ decodes the stored representation. Non-string input becomes empty text. This getter limit is normalization, not a rejecting input maxLength or proof of a custom action hook or database column capacity.",
                "examples": [
                  "Example"
                ],
                "x-edoobox-requiredOnCreate": true,
                "x-edoobox-sourceLine": 62
              },
              "vat_percent": {
                "anyOf": [
                  {
                    "type": "number"
                  },
                  {
                    "type": "string",
                    "description": "Numeric string accepted by PHP number_format."
                  },
                  {
                    "type": "boolean"
                  },
                  {
                    "type": "null"
                  }
                ],
                "description": "number_format rounds/formats to 2 decimals before persistence. Numeric strings supported; no min/max/multipleOf rejection.",
                "x-edoobox-schemaStatus": "source-reviewed",
                "x-edoobox-canonicalType": "number",
                "examples": [
                  8.1
                ],
                "x-edoobox-contractSource": [
                  {
                    "file": "application/models/v2/Vat.php",
                    "line": 75,
                    "reason": "Exact Structure declaration: get converts incoming wire input; set converts response output.",
                    "sha256": "e1cdb6c7a92dd3e1fe2fb08e96946d3a70502cbc1d12fa7b572eae1d170f0eef"
                  },
                  {
                    "file": "application/models/v2/Vat.php",
                    "line": 152,
                    "reason": "Exact POST/PUT callers use API_DATA and Modal Vat.",
                    "sha256": "e1cdb6c7a92dd3e1fe2fb08e96946d3a70502cbc1d12fa7b572eae1d170f0eef"
                  },
                  {
                    "file": "application/models/v2/API_DATA.php",
                    "line": 1278,
                    "reason": "Single POST injects absent insert_default as 0, executes incoming getters (not update func) and calls before-insert hook.",
                    "sha256": "c0e15d26a7a4f3fb3c25e35557d4420ad395b2af3925caec292de08e32ebf44c"
                  },
                  {
                    "file": "application/models/v2/API_DATA.php",
                    "line": 1797,
                    "reason": "Direct update getter, no resource hook.",
                    "sha256": "c0e15d26a7a4f3fb3c25e35557d4420ad395b2af3925caec292de08e32ebf44c"
                  },
                  {
                    "file": "application/models/v2/API_DATA.php",
                    "line": 543,
                    "reason": "Structure require.insert marks presence required.",
                    "sha256": "c0e15d26a7a4f3fb3c25e35557d4420ad395b2af3925caec292de08e32ebf44c"
                  },
                  {
                    "file": "application/models/v2/API_DATA.php",
                    "line": 1331,
                    "reason": "Missing single-create required field rejects request.",
                    "sha256": "c0e15d26a7a4f3fb3c25e35557d4420ad395b2af3925caec292de08e32ebf44c"
                  },
                  {
                    "file": "docs/openapi/reviews/payment-fields.json",
                    "line": 1,
                    "reason": "Independent field-level source review, direction applicability, examples and explicit runtime limitations.",
                    "sha256": "4a3097e873943fa5090a2fd52086762dc36a50d399bdd78ad6b20e6ed595639a"
                  }
                ]
              },
              "b2b": {
                "description": "Only literal JSON true enables B2B; all other values normalize to 0. No type rejection.",
                "x-edoobox-schemaStatus": "source-reviewed-normalization",
                "x-edoobox-canonicalType": "boolean",
                "examples": [
                  true,
                  false
                ],
                "x-edoobox-contractSource": [
                  {
                    "file": "application/models/v2/Vat.php",
                    "line": 88,
                    "reason": "Exact Structure declaration: get converts incoming wire input; set converts response output.",
                    "sha256": "e1cdb6c7a92dd3e1fe2fb08e96946d3a70502cbc1d12fa7b572eae1d170f0eef"
                  },
                  {
                    "file": "application/models/v2/Vat.php",
                    "line": 152,
                    "reason": "Exact POST/PUT callers use API_DATA and Modal Vat.",
                    "sha256": "e1cdb6c7a92dd3e1fe2fb08e96946d3a70502cbc1d12fa7b572eae1d170f0eef"
                  },
                  {
                    "file": "application/models/v2/API_DATA.php",
                    "line": 1278,
                    "reason": "Single POST injects absent insert_default as 0, executes incoming getters (not update func) and calls before-insert hook.",
                    "sha256": "c0e15d26a7a4f3fb3c25e35557d4420ad395b2af3925caec292de08e32ebf44c"
                  },
                  {
                    "file": "application/models/v2/API_DATA.php",
                    "line": 1797,
                    "reason": "No hook; direct getter produces 1/0, never strict false.",
                    "sha256": "c0e15d26a7a4f3fb3c25e35557d4420ad395b2af3925caec292de08e32ebf44c"
                  },
                  {
                    "file": "docs/openapi/reviews/payment-fields.json",
                    "line": 1,
                    "reason": "Independent field-level source review, direction applicability, examples and explicit runtime limitations.",
                    "sha256": "4a3097e873943fa5090a2fd52086762dc36a50d399bdd78ad6b20e6ed595639a"
                  }
                ]
              },
              "country": {
                "type": "string",
                "pattern": "^[a-z0-9]+_[a-f0-9]{12}_-?[0-9]+$",
                "description": "Opaque edoobox v2 object ID returned by this account. Never send a raw database ID. The synthetic example is illustrative and is not a real record.",
                "examples": [
                  "country_012345abcdef_123456"
                ],
                "x-edoobox-requiredOnCreate": true,
                "x-edoobox-schemaStatus": "source-inferred",
                "x-edoobox-sourceLine": 97
              },
              "default": {
                "description": "Canonical boolean. Native PUT casts raw default to int, stores that integer and resets other account defaults when nonzero. Both field hooks use the same activity rule: nonzero default activates; otherwise supplied status selects active/inactive; otherwise current activity remains. The VAT must exist in this account before any default clear. Existing raw-truthiness validation still rejects unsetting/deactivating a current default or raw status=false with raw default=true. Thus status:false plus default:false deactivates a nondefault VAT in either JSON key order. POST uses its loose-truthiness getter and separate before-insert hook.",
                "x-edoobox-schemaStatus": "source-reviewed-normalization",
                "x-edoobox-canonicalType": "boolean",
                "examples": [
                  false,
                  true
                ],
                "x-edoobox-contractSource": [
                  {
                    "file": "application/models/v2/Vat.php",
                    "line": 110,
                    "reason": "Exact Structure declaration: get converts incoming wire input; set converts response output.",
                    "sha256": "e1cdb6c7a92dd3e1fe2fb08e96946d3a70502cbc1d12fa7b572eae1d170f0eef"
                  },
                  {
                    "file": "application/models/v2/Vat.php",
                    "line": 152,
                    "reason": "Exact POST/PUT callers use API_DATA and Modal Vat.",
                    "sha256": "e1cdb6c7a92dd3e1fe2fb08e96946d3a70502cbc1d12fa7b572eae1d170f0eef"
                  },
                  {
                    "file": "application/models/v2/API_DATA.php",
                    "line": 1278,
                    "reason": "Single POST injects absent insert_default as 0, executes incoming getters (not update func) and calls before-insert hook.",
                    "sha256": "c0e15d26a7a4f3fb3c25e35557d4420ad395b2af3925caec292de08e32ebf44c"
                  },
                  {
                    "file": "application/models/v2/API_DATA.php",
                    "line": 1792,
                    "reason": "PUT tests update flag then dispatches exact resource hook: true succeeds, array merges, false returns ED90100.",
                    "sha256": "c0e15d26a7a4f3fb3c25e35557d4420ad395b2af3925caec292de08e32ebf44c"
                  },
                  {
                    "file": "application/models/v2/Vatfunc.php",
                    "line": 10,
                    "reason": "Actual Vatfunc hook; Permissionfunc same-named method is not dispatched.",
                    "sha256": "3d8cef71f39ce3b4cc04f2adc95b8ee0f8d490983db2d55e1f6ec6445a2c63ee"
                  },
                  {
                    "file": "application/models/v2/Vatfunc.php",
                    "line": 40,
                    "reason": "POST before-insert default behavior; no update validation call.",
                    "sha256": "3d8cef71f39ce3b4cc04f2adc95b8ee0f8d490983db2d55e1f6ec6445a2c63ee"
                  },
                  {
                    "file": "application/models/v2/Vatfunc.php",
                    "line": 80,
                    "reason": "Raw-truthiness validation forbids removal/deactivation of current default and status=false with default=true.",
                    "sha256": "3d8cef71f39ce3b4cc04f2adc95b8ee0f8d490983db2d55e1f6ec6445a2c63ee"
                  },
                  {
                    "file": "docs/openapi/reviews/payment-fields.json",
                    "line": 1,
                    "reason": "Independent field-level source review, direction applicability, examples and explicit runtime limitations.",
                    "sha256": "4a3097e873943fa5090a2fd52086762dc36a50d399bdd78ad6b20e6ed595639a"
                  },
                  {
                    "file": "application/models/v2/Vatfunc.php",
                    "line": 58,
                    "lineEnd": 70,
                    "reason": "Every update resolves the VAT row by id and firma_info_id; missing or foreign rows throw ED80100 before default-clearing writes.",
                    "sha256": "3d8cef71f39ce3b4cc04f2adc95b8ee0f8d490983db2d55e1f6ec6445a2c63ee"
                  },
                  {
                    "file": "application/models/v2/Vatfunc.php",
                    "line": 72,
                    "lineEnd": 78,
                    "reason": "Both field hooks merge the same aktiv value: nonzero integer default activates; otherwise supplied integer status wins; otherwise existing activity remains. JSON key order cannot restore the old activity.",
                    "sha256": "3d8cef71f39ce3b4cc04f2adc95b8ee0f8d490983db2d55e1f6ec6445a2c63ee"
                  }
                ]
              },
              "last_change": {
                "description": "Client value ignored; server time used, including update_default injection when absent.",
                "x-edoobox-schemaStatus": "source-reviewed",
                "x-edoobox-ignoredInput": true,
                "examples": [
                  "2001-01-01T00:00:00Z",
                  null
                ],
                "x-edoobox-contractSource": [
                  {
                    "file": "application/models/v2/Vat.php",
                    "line": 120,
                    "reason": "Exact Structure declaration: get converts incoming wire input; set converts response output.",
                    "sha256": "e1cdb6c7a92dd3e1fe2fb08e96946d3a70502cbc1d12fa7b572eae1d170f0eef"
                  },
                  {
                    "file": "application/models/v2/Vat.php",
                    "line": 152,
                    "reason": "Exact POST/PUT callers use API_DATA and Modal Vat.",
                    "sha256": "e1cdb6c7a92dd3e1fe2fb08e96946d3a70502cbc1d12fa7b572eae1d170f0eef"
                  },
                  {
                    "file": "application/models/v2/API_DATA.php",
                    "line": 1278,
                    "reason": "Single POST injects absent insert_default as 0, executes incoming getters (not update func) and calls before-insert hook.",
                    "sha256": "c0e15d26a7a4f3fb3c25e35557d4420ad395b2af3925caec292de08e32ebf44c"
                  },
                  {
                    "file": "application/models/v2/API_DATA.php",
                    "line": 1779,
                    "reason": "PUT injects update_default when absent.",
                    "sha256": "c0e15d26a7a4f3fb3c25e35557d4420ad395b2af3925caec292de08e32ebf44c"
                  },
                  {
                    "file": "application/models/v2/API_DATA.php",
                    "line": 1568,
                    "reason": "Batch POST only processes supplied values.",
                    "sha256": "c0e15d26a7a4f3fb3c25e35557d4420ad395b2af3925caec292de08e32ebf44c"
                  },
                  {
                    "file": "application/helpers/edooboxhelp_helper.php",
                    "line": 11629,
                    "reason": "Actual dQ date-time/false output.",
                    "sha256": "090d351b5bde81813c7a829bedf2f1f9f978fce5765f246989779f996198934e"
                  },
                  {
                    "file": "docs/openapi/reviews/payment-fields.json",
                    "line": 1,
                    "reason": "Independent field-level source review, direction applicability, examples and explicit runtime limitations.",
                    "sha256": "4a3097e873943fa5090a2fd52086762dc36a50d399bdd78ad6b20e6ed595639a"
                  }
                ]
              }
            },
            "additionalProperties": true,
            "description": "Source-declared fields; action-specific and account validation still apply.",
            "minProperties": 1,
            "x-edoobox-readOnlyFields": [],
            "x-edoobox-clientRestriction": "Read-only fields are forbidden by this client contract to prevent silently ignored writes; the legacy API itself skips them. Explicit source-marked update context fields remain accepted for hook validation without changing their immutable database columns."
          },
          "id": {
            "type": "string",
            "pattern": "^[a-z0-9]+_[a-f0-9]{12}_-?[0-9]+$",
            "description": "Opaque edoobox v2 object ID returned by this account. Never send a raw database ID. The synthetic example is illustrative and is not a real record.",
            "examples": [
              "vat_012345abcdef_123456"
            ]
          }
        },
        "additionalProperties": true,
        "required": [
          "data",
          "id"
        ]
      },
      "examples": {
        "request": {
          "summary": "Mehrwertsteuersatz aktualisieren",
          "value": {
            "data": {
              "description": "Aktualisierter Normalsatz",
              "status": true
            },
            "id": "vat_012345abcdef_123456"
          }
        }
      }
    }
  }
}
```

## Antworten

HTTP-Status und Antwortinhalt gemeinsam auswerten. Die folgenden Beschreibungen und Schemata sind die Angaben der Quelldatei.

```json
{
  "200": {
    "description": "update und öffentliche ID.",
    "content": {
      "application/json": {
        "example": {
          "success": true,
          "error": false,
          "data": {
            "update": true,
            "id": "vat_012345abcdef_123456"
          }
        },
        "schema": {
          "type": "object",
          "properties": {
            "success": {
              "type": "boolean"
            },
            "error": {
              "type": [
                "boolean",
                "string"
              ]
            },
            "error_code": {
              "type": "string"
            },
            "data": {
              "type": "object",
              "properties": {
                "update": {
                  "type": "boolean"
                },
                "id": {
                  "type": "string",
                  "pattern": "^vat_[a-f0-9]{12}_-?[0-9]+$",
                  "description": "Öffentliche v2-ID aus diesem Konto; keine interne Datenbank-ID.",
                  "examples": [
                    "vat_012345abcdef_123456"
                  ]
                }
              },
              "additionalProperties": true
            },
            "type": {
              "type": "string"
            }
          },
          "additionalProperties": true
        }
      }
    },
    "headers": {
      "X-Edoobox-Revision": {
        "schema": {
          "type": "string",
          "pattern": "^[a-f0-9]{32}$"
        },
        "description": "Rotated account revision supplied for the next action in one reviewed sequence."
      }
    }
  },
  "400": {
    "description": "Invalid request.",
    "content": {
      "application/json": {
        "example": {
          "success": false,
          "error": "ED40006"
        }
      }
    }
  },
  "401": {
    "description": "Missing/expired token, missing account context, account paused or model-specific authorization failure.",
    "content": {
      "application/json": {
        "example": {
          "success": false,
          "error": "ED40103"
        }
      }
    }
  },
  "402": {
    "description": "Missing/invalid action data or subscription/operation restriction.",
    "content": {
      "application/json": {
        "example": {
          "success": false,
          "error": "ED80100"
        }
      }
    }
  },
  "403": {
    "description": "Permission denied. Browser CORS rejection may have an empty body.",
    "content": {
      "application/json": {
        "example": {
          "success": false,
          "error": "ED40340"
        }
      }
    }
  },
  "404": {
    "description": "Unknown resource/action or unsupported method.",
    "content": {
      "application/json": {
        "example": {
          "success": false,
          "error": "ED80019"
        }
      }
    }
  },
  "409": {
    "description": "The account changed after the reviewed read. No domain operation is dispatched; obtain fresh state and review again.",
    "content": {
      "application/json": {
        "schema": {
          "type": "object",
          "additionalProperties": true
        },
        "example": {
          "error": "ED40901",
          "error_code": "mutation_revision_conflict"
        }
      }
    }
  },
  "422": {
    "description": "Validation failed.",
    "content": {
      "application/json": {
        "example": {
          "success": false,
          "error": "ED80020"
        }
      }
    }
  },
  "429": {
    "description": "Request/login rate limit exceeded. Honor Retry-After when supplied; legacy rate-limit paths may omit it. Retry only proven reads within a bounded deadline; a mutation is never automatically replayed after an ambiguous response.",
    "content": {
      "application/json": {
        "example": {
          "success": false,
          "error": "ED42902"
        }
      }
    },
    "headers": {
      "Retry-After": {
        "description": "Optional server delay in whole seconds or an HTTP date. Absence is not permission for an immediate retry.",
        "schema": {
          "type": "string",
          "examples": [
            "30"
          ]
        }
      }
    }
  },
  "502": {
    "description": "Server-side operation failed.",
    "content": {
      "application/json": {
        "example": {
          "success": false,
          "error": "ED50201"
        }
      }
    }
  },
  "503": {
    "description": "The account mutation lock or revision store is unavailable. No unprotected fallback is executed.",
    "headers": {
      "Retry-After": {
        "schema": {
          "type": "integer",
          "const": 1
        }
      }
    },
    "content": {
      "application/json": {
        "schema": {
          "type": "object",
          "additionalProperties": true
        },
        "example": {
          "error": "ED50301",
          "error_code": "mutation_revision_busy"
        }
      }
    }
  }
}
```

## Aufrufbeispiele

Anpassen vor dem Ausführen. Platzhalter und veröffentlichte Beispiele sind synthetisch. Die Beispiele senden hier keine Anfrage; sie ergänzen keine unbekannten Pflichtfelder.

### cURL

```sh
# Zeigt Authentifizierungsalternative 1; alle Verfahren dieser Alternative sind gemeinsam erforderlich.
# Request Body: synthetisches Beispiel aus der Spezifikation; Werte und Vollständigkeit vor Verwendung prüfen.
: "${API_ORIGIN:?API_ORIGIN setzen}"
: "${AUTH_BEARERAUTH:?AUTH_BEARERAUTH setzen}"
: "${AUTH_ACCOUNTCONTEXT:?AUTH_ACCOUNTCONTEXT setzen}"
cat > payload.json <<'EDOOBOX_JSON_EXAMPLE'
{
  "data": {
    "description": "Aktualisierter Normalsatz",
    "status": true
  },
  "id": "vat_012345abcdef_123456"
}
EDOOBOX_JSON_EXAMPLE
curl --request 'PUT' \
  --url "${API_ORIGIN%/}"'/v2/vat' \
  --header 'Authorization: Bearer '"${AUTH_BEARERAUTH}" \
  --header 'edid: '"${AUTH_ACCOUNTCONTEXT}" \
  --header 'Content-Type: application/json' \
  --data-binary '@payload.json'
```

### JavaScript (Node.js)

```javascript
// Zeigt Authentifizierungsalternative 1; alle Verfahren dieser Alternative sind gemeinsam erforderlich.
// Request Body: synthetisches Beispiel aus der Spezifikation; Werte und Vollständigkeit vor Verwendung prüfen.
const required = (name) => {
  const value = process.env[name];
  if (!value) throw new Error(`Set ${name}`);
  return value;
};
let path = "/v2/vat";
const origin = required('API_ORIGIN');
const url = new URL((origin.endsWith('/') ? origin.slice(0, -1) : origin) + path);
const headers = {};
headers["Authorization"] = "Bearer " + required("AUTH_BEARERAUTH");
headers["edid"] = "" + required("AUTH_ACCOUNTCONTEXT");
headers['Content-Type'] = "application/json";
const body = JSON.stringify({
  "data": {
    "description": "Aktualisierter Normalsatz",
    "status": true
  },
  "id": "vat_012345abcdef_123456"
});
const response = await fetch(url, { method: "PUT", headers, body, redirect: 'manual' });
const text = await response.text();
console.log(response.status, text);
// HTTP-Status und dokumentierte error/success-Felder gemeinsam prüfen.
```

### Python

```python
# Zeigt Authentifizierungsalternative 1; alle Verfahren dieser Alternative sind gemeinsam erforderlich.
# Request Body: synthetisches Beispiel aus der Spezifikation; Werte und Vollständigkeit vor Verwendung prüfen.
import os
import urllib.parse
import urllib.request
import urllib.error

path = "/v2/vat"
url = os.environ["API_ORIGIN"].rstrip("/") + path
headers = {}
headers["Authorization"] = "Bearer " + os.environ["AUTH_BEARERAUTH"]
headers["edid"] = "" + os.environ["AUTH_ACCOUNTCONTEXT"]
headers["Content-Type"] = "application/json"
body = "{\"data\":{\"description\":\"Aktualisierter Normalsatz\",\"status\":true},\"id\":\"vat_012345abcdef_123456\"}".encode("utf-8")

# Redirects nicht automatisch verfolgen.
class NoRedirect(urllib.request.HTTPRedirectHandler):
    def redirect_request(self, req, fp, code, msg, headers, newurl):
        return None
request = urllib.request.Request(url, headers=headers, method="PUT", data=body)
try:
    response = urllib.request.build_opener(NoRedirect).open(request, timeout=30)
except urllib.error.HTTPError as error:
    response = error
print(response.status, response.read().decode("utf-8", errors="replace"))
# HTTP-Status und dokumentierte error/success-Felder gemeinsam prüfen.
```

## Vollständige Operationsdefinition und edoobox-Hinweise

Alle Originalfelder einschliesslich `x-edoobox-*`, requestBody und responses bleiben erhalten. Teilweise dokumentierte Schemata sind kein vollständiger Validierungsvertrag.

```json
{
  "operationId": "put_v2_vat",
  "summary": "Mehrwertsteuersatz aktualisieren",
  "description": "Aktualisiert die übergebenen Felder eines eigenen Mehrwertsteuersatzes und leert den Steuer-Cache. Der aktuelle Standardsatz darf nicht deaktiviert und sein Standardkennzeichen nicht entfernt werden. Ein neuer Standard aktiviert den Satz und entfernt andere Standards. Die ID wird im Pfad oder beim Basisendpunkt im äußeren id-Feld übergeben.",
  "tags": [
    "vat"
  ],
  "security": [
    {
      "bearerAuth": [],
      "accountContext": []
    },
    {
      "sessionCookie": [],
      "accountContext": []
    }
  ],
  "parameters": [
    {
      "name": "language",
      "in": "header",
      "required": false,
      "description": "Account language code, where the resource supports setLanguage().",
      "schema": {
        "type": "string",
        "examples": [
          "de"
        ]
      }
    },
    {
      "name": "X-Edoobox-If-Revision",
      "in": "header",
      "required": false,
      "schema": {
        "type": "string",
        "pattern": "^[a-f0-9]{32}$",
        "examples": [
          "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"
        ]
      },
      "description": "Optional account mutation revision from a preceding authenticated auth-context snapshot. The dispatcher compares it while holding the account lock; mismatch409 requires a new review."
    }
  ],
  "responses": {
    "200": {
      "description": "update und öffentliche ID.",
      "content": {
        "application/json": {
          "example": {
            "success": true,
            "error": false,
            "data": {
              "update": true,
              "id": "vat_012345abcdef_123456"
            }
          },
          "schema": {
            "type": "object",
            "properties": {
              "success": {
                "type": "boolean"
              },
              "error": {
                "type": [
                  "boolean",
                  "string"
                ]
              },
              "error_code": {
                "type": "string"
              },
              "data": {
                "type": "object",
                "properties": {
                  "update": {
                    "type": "boolean"
                  },
                  "id": {
                    "type": "string",
                    "pattern": "^vat_[a-f0-9]{12}_-?[0-9]+$",
                    "description": "Öffentliche v2-ID aus diesem Konto; keine interne Datenbank-ID.",
                    "examples": [
                      "vat_012345abcdef_123456"
                    ]
                  }
                },
                "additionalProperties": true
              },
              "type": {
                "type": "string"
              }
            },
            "additionalProperties": true
          }
        }
      },
      "headers": {
        "X-Edoobox-Revision": {
          "schema": {
            "type": "string",
            "pattern": "^[a-f0-9]{32}$"
          },
          "description": "Rotated account revision supplied for the next action in one reviewed sequence."
        }
      }
    },
    "400": {
      "description": "Invalid request.",
      "content": {
        "application/json": {
          "example": {
            "success": false,
            "error": "ED40006"
          }
        }
      }
    },
    "401": {
      "description": "Missing/expired token, missing account context, account paused or model-specific authorization failure.",
      "content": {
        "application/json": {
          "example": {
            "success": false,
            "error": "ED40103"
          }
        }
      }
    },
    "402": {
      "description": "Missing/invalid action data or subscription/operation restriction.",
      "content": {
        "application/json": {
          "example": {
            "success": false,
            "error": "ED80100"
          }
        }
      }
    },
    "403": {
      "description": "Permission denied. Browser CORS rejection may have an empty body.",
      "content": {
        "application/json": {
          "example": {
            "success": false,
            "error": "ED40340"
          }
        }
      }
    },
    "404": {
      "description": "Unknown resource/action or unsupported method.",
      "content": {
        "application/json": {
          "example": {
            "success": false,
            "error": "ED80019"
          }
        }
      }
    },
    "409": {
      "description": "The account changed after the reviewed read. No domain operation is dispatched; obtain fresh state and review again.",
      "content": {
        "application/json": {
          "schema": {
            "type": "object",
            "additionalProperties": true
          },
          "example": {
            "error": "ED40901",
            "error_code": "mutation_revision_conflict"
          }
        }
      }
    },
    "422": {
      "description": "Validation failed.",
      "content": {
        "application/json": {
          "example": {
            "success": false,
            "error": "ED80020"
          }
        }
      }
    },
    "429": {
      "description": "Request/login rate limit exceeded. Honor Retry-After when supplied; legacy rate-limit paths may omit it. Retry only proven reads within a bounded deadline; a mutation is never automatically replayed after an ambiguous response.",
      "content": {
        "application/json": {
          "example": {
            "success": false,
            "error": "ED42902"
          }
        }
      },
      "headers": {
        "Retry-After": {
          "description": "Optional server delay in whole seconds or an HTTP date. Absence is not permission for an immediate retry.",
          "schema": {
            "type": "string",
            "examples": [
              "30"
            ]
          }
        }
      }
    },
    "502": {
      "description": "Server-side operation failed.",
      "content": {
        "application/json": {
          "example": {
            "success": false,
            "error": "ED50201"
          }
        }
      }
    },
    "503": {
      "description": "The account mutation lock or revision store is unavailable. No unprotected fallback is executed.",
      "headers": {
        "Retry-After": {
          "schema": {
            "type": "integer",
            "const": 1
          }
        }
      },
      "content": {
        "application/json": {
          "schema": {
            "type": "object",
            "additionalProperties": true
          },
          "example": {
            "error": "ED50301",
            "error_code": "mutation_revision_busy"
          }
        }
      }
    }
  },
  "x-edoobox-mutates-state": true,
  "requestBody": {
    "required": true,
    "content": {
      "application/json": {
        "schema": {
          "type": "object",
          "properties": {
            "data": {
              "type": "object",
              "properties": {
                "id": false,
                "status": {
                  "description": "Canonical boolean. Native PUT derives activity from integer casts, not a rejecting boolean/0-or-1 input guard. Both field hooks use the same activity rule: nonzero default activates; otherwise supplied status selects active/inactive; otherwise current activity remains. The VAT must exist in this account before any default clear. Existing raw-truthiness validation still rejects unsetting/deactivating a current default or raw status=false with raw default=true. Thus status:false plus default:false deactivates a nondefault VAT in either JSON key order. POST uses its loose-truthiness getter and separate before-insert hook.",
                  "x-edoobox-schemaStatus": "source-reviewed-normalization",
                  "x-edoobox-canonicalType": "boolean",
                  "examples": [
                    false,
                    true
                  ],
                  "x-edoobox-contractSource": [
                    {
                      "file": "application/models/v2/Vat.php",
                      "line": 38,
                      "reason": "Exact Structure declaration: get converts incoming wire input; set converts response output.",
                      "sha256": "e1cdb6c7a92dd3e1fe2fb08e96946d3a70502cbc1d12fa7b572eae1d170f0eef"
                    },
                    {
                      "file": "application/models/v2/Vat.php",
                      "line": 152,
                      "reason": "Exact POST/PUT callers use API_DATA and Modal Vat.",
                      "sha256": "e1cdb6c7a92dd3e1fe2fb08e96946d3a70502cbc1d12fa7b572eae1d170f0eef"
                    },
                    {
                      "file": "application/models/v2/API_DATA.php",
                      "line": 1278,
                      "reason": "Single POST injects absent insert_default as 0, executes incoming getters (not update func) and calls before-insert hook.",
                      "sha256": "c0e15d26a7a4f3fb3c25e35557d4420ad395b2af3925caec292de08e32ebf44c"
                    },
                    {
                      "file": "application/models/v2/API_DATA.php",
                      "line": 1792,
                      "reason": "PUT tests update flag then dispatches exact resource hook: true succeeds, array merges, false returns ED90100.",
                      "sha256": "c0e15d26a7a4f3fb3c25e35557d4420ad395b2af3925caec292de08e32ebf44c"
                    },
                    {
                      "file": "application/models/v2/Vatfunc.php",
                      "line": 31,
                      "reason": "Actual Vatfunc hook; Permissionfunc same-named method is not dispatched.",
                      "sha256": "3d8cef71f39ce3b4cc04f2adc95b8ee0f8d490983db2d55e1f6ec6445a2c63ee"
                    },
                    {
                      "file": "application/models/v2/Vatfunc.php",
                      "line": 40,
                      "reason": "POST before-insert default behavior; no update validation call.",
                      "sha256": "3d8cef71f39ce3b4cc04f2adc95b8ee0f8d490983db2d55e1f6ec6445a2c63ee"
                    },
                    {
                      "file": "application/models/v2/Vatfunc.php",
                      "line": 80,
                      "reason": "Raw-truthiness validation forbids removal/deactivation of current default and status=false with default=true.",
                      "sha256": "3d8cef71f39ce3b4cc04f2adc95b8ee0f8d490983db2d55e1f6ec6445a2c63ee"
                    },
                    {
                      "file": "docs/openapi/reviews/payment-fields.json",
                      "line": 1,
                      "reason": "Independent field-level source review, direction applicability, examples and explicit runtime limitations.",
                      "sha256": "4a3097e873943fa5090a2fd52086762dc36a50d399bdd78ad6b20e6ed595639a"
                    },
                    {
                      "file": "application/models/v2/Vatfunc.php",
                      "line": 58,
                      "lineEnd": 70,
                      "reason": "Every update resolves the VAT row by id and firma_info_id; missing or foreign rows throw ED80100 before default-clearing writes.",
                      "sha256": "3d8cef71f39ce3b4cc04f2adc95b8ee0f8d490983db2d55e1f6ec6445a2c63ee"
                    },
                    {
                      "file": "application/models/v2/Vatfunc.php",
                      "line": 72,
                      "lineEnd": 78,
                      "reason": "Both field hooks merge the same aktiv value: nonzero integer default activates; otherwise supplied integer status wins; otherwise existing activity remains. JSON key order cannot restore the old activity.",
                      "sha256": "3d8cef71f39ce3b4cc04f2adc95b8ee0f8d490983db2d55e1f6ec6445a2c63ee"
                    }
                  ]
                },
                "description": {
                  "x-edoobox-canonicalType": "string",
                  "x-edoobox-maxStoredLength": 250,
                  "x-edoobox-normalization": "The aP getter trims text, replaces newlines and limits the legacy escaped storage representation to maxStoredLength UTF-8 characters without splitting escape pairs; aQ decodes the stored representation. Non-string input becomes empty text. This getter limit is normalization, not a rejecting input maxLength or proof of a custom action hook or database column capacity.",
                  "examples": [
                    "Example"
                  ],
                  "x-edoobox-requiredOnCreate": true,
                  "x-edoobox-sourceLine": 49
                },
                "vat_number": {
                  "x-edoobox-canonicalType": "string",
                  "x-edoobox-maxStoredLength": 250,
                  "x-edoobox-normalization": "The aP getter trims text, replaces newlines and limits the legacy escaped storage representation to maxStoredLength UTF-8 characters without splitting escape pairs; aQ decodes the stored representation. Non-string input becomes empty text. This getter limit is normalization, not a rejecting input maxLength or proof of a custom action hook or database column capacity.",
                  "examples": [
                    "Example"
                  ],
                  "x-edoobox-requiredOnCreate": true,
                  "x-edoobox-sourceLine": 62
                },
                "vat_percent": {
                  "anyOf": [
                    {
                      "type": "number"
                    },
                    {
                      "type": "string",
                      "description": "Numeric string accepted by PHP number_format."
                    },
                    {
                      "type": "boolean"
                    },
                    {
                      "type": "null"
                    }
                  ],
                  "description": "number_format rounds/formats to 2 decimals before persistence. Numeric strings supported; no min/max/multipleOf rejection.",
                  "x-edoobox-schemaStatus": "source-reviewed",
                  "x-edoobox-canonicalType": "number",
                  "examples": [
                    8.1
                  ],
                  "x-edoobox-contractSource": [
                    {
                      "file": "application/models/v2/Vat.php",
                      "line": 75,
                      "reason": "Exact Structure declaration: get converts incoming wire input; set converts response output.",
                      "sha256": "e1cdb6c7a92dd3e1fe2fb08e96946d3a70502cbc1d12fa7b572eae1d170f0eef"
                    },
                    {
                      "file": "application/models/v2/Vat.php",
                      "line": 152,
                      "reason": "Exact POST/PUT callers use API_DATA and Modal Vat.",
                      "sha256": "e1cdb6c7a92dd3e1fe2fb08e96946d3a70502cbc1d12fa7b572eae1d170f0eef"
                    },
                    {
                      "file": "application/models/v2/API_DATA.php",
                      "line": 1278,
                      "reason": "Single POST injects absent insert_default as 0, executes incoming getters (not update func) and calls before-insert hook.",
                      "sha256": "c0e15d26a7a4f3fb3c25e35557d4420ad395b2af3925caec292de08e32ebf44c"
                    },
                    {
                      "file": "application/models/v2/API_DATA.php",
                      "line": 1797,
                      "reason": "Direct update getter, no resource hook.",
                      "sha256": "c0e15d26a7a4f3fb3c25e35557d4420ad395b2af3925caec292de08e32ebf44c"
                    },
                    {
                      "file": "application/models/v2/API_DATA.php",
                      "line": 543,
                      "reason": "Structure require.insert marks presence required.",
                      "sha256": "c0e15d26a7a4f3fb3c25e35557d4420ad395b2af3925caec292de08e32ebf44c"
                    },
                    {
                      "file": "application/models/v2/API_DATA.php",
                      "line": 1331,
                      "reason": "Missing single-create required field rejects request.",
                      "sha256": "c0e15d26a7a4f3fb3c25e35557d4420ad395b2af3925caec292de08e32ebf44c"
                    },
                    {
                      "file": "docs/openapi/reviews/payment-fields.json",
                      "line": 1,
                      "reason": "Independent field-level source review, direction applicability, examples and explicit runtime limitations.",
                      "sha256": "4a3097e873943fa5090a2fd52086762dc36a50d399bdd78ad6b20e6ed595639a"
                    }
                  ]
                },
                "b2b": {
                  "description": "Only literal JSON true enables B2B; all other values normalize to 0. No type rejection.",
                  "x-edoobox-schemaStatus": "source-reviewed-normalization",
                  "x-edoobox-canonicalType": "boolean",
                  "examples": [
                    true,
                    false
                  ],
                  "x-edoobox-contractSource": [
                    {
                      "file": "application/models/v2/Vat.php",
                      "line": 88,
                      "reason": "Exact Structure declaration: get converts incoming wire input; set converts response output.",
                      "sha256": "e1cdb6c7a92dd3e1fe2fb08e96946d3a70502cbc1d12fa7b572eae1d170f0eef"
                    },
                    {
                      "file": "application/models/v2/Vat.php",
                      "line": 152,
                      "reason": "Exact POST/PUT callers use API_DATA and Modal Vat.",
                      "sha256": "e1cdb6c7a92dd3e1fe2fb08e96946d3a70502cbc1d12fa7b572eae1d170f0eef"
                    },
                    {
                      "file": "application/models/v2/API_DATA.php",
                      "line": 1278,
                      "reason": "Single POST injects absent insert_default as 0, executes incoming getters (not update func) and calls before-insert hook.",
                      "sha256": "c0e15d26a7a4f3fb3c25e35557d4420ad395b2af3925caec292de08e32ebf44c"
                    },
                    {
                      "file": "application/models/v2/API_DATA.php",
                      "line": 1797,
                      "reason": "No hook; direct getter produces 1/0, never strict false.",
                      "sha256": "c0e15d26a7a4f3fb3c25e35557d4420ad395b2af3925caec292de08e32ebf44c"
                    },
                    {
                      "file": "docs/openapi/reviews/payment-fields.json",
                      "line": 1,
                      "reason": "Independent field-level source review, direction applicability, examples and explicit runtime limitations.",
                      "sha256": "4a3097e873943fa5090a2fd52086762dc36a50d399bdd78ad6b20e6ed595639a"
                    }
                  ]
                },
                "country": {
                  "type": "string",
                  "pattern": "^[a-z0-9]+_[a-f0-9]{12}_-?[0-9]+$",
                  "description": "Opaque edoobox v2 object ID returned by this account. Never send a raw database ID. The synthetic example is illustrative and is not a real record.",
                  "examples": [
                    "country_012345abcdef_123456"
                  ],
                  "x-edoobox-requiredOnCreate": true,
                  "x-edoobox-schemaStatus": "source-inferred",
                  "x-edoobox-sourceLine": 97
                },
                "default": {
                  "description": "Canonical boolean. Native PUT casts raw default to int, stores that integer and resets other account defaults when nonzero. Both field hooks use the same activity rule: nonzero default activates; otherwise supplied status selects active/inactive; otherwise current activity remains. The VAT must exist in this account before any default clear. Existing raw-truthiness validation still rejects unsetting/deactivating a current default or raw status=false with raw default=true. Thus status:false plus default:false deactivates a nondefault VAT in either JSON key order. POST uses its loose-truthiness getter and separate before-insert hook.",
                  "x-edoobox-schemaStatus": "source-reviewed-normalization",
                  "x-edoobox-canonicalType": "boolean",
                  "examples": [
                    false,
                    true
                  ],
                  "x-edoobox-contractSource": [
                    {
                      "file": "application/models/v2/Vat.php",
                      "line": 110,
                      "reason": "Exact Structure declaration: get converts incoming wire input; set converts response output.",
                      "sha256": "e1cdb6c7a92dd3e1fe2fb08e96946d3a70502cbc1d12fa7b572eae1d170f0eef"
                    },
                    {
                      "file": "application/models/v2/Vat.php",
                      "line": 152,
                      "reason": "Exact POST/PUT callers use API_DATA and Modal Vat.",
                      "sha256": "e1cdb6c7a92dd3e1fe2fb08e96946d3a70502cbc1d12fa7b572eae1d170f0eef"
                    },
                    {
                      "file": "application/models/v2/API_DATA.php",
                      "line": 1278,
                      "reason": "Single POST injects absent insert_default as 0, executes incoming getters (not update func) and calls before-insert hook.",
                      "sha256": "c0e15d26a7a4f3fb3c25e35557d4420ad395b2af3925caec292de08e32ebf44c"
                    },
                    {
                      "file": "application/models/v2/API_DATA.php",
                      "line": 1792,
                      "reason": "PUT tests update flag then dispatches exact resource hook: true succeeds, array merges, false returns ED90100.",
                      "sha256": "c0e15d26a7a4f3fb3c25e35557d4420ad395b2af3925caec292de08e32ebf44c"
                    },
                    {
                      "file": "application/models/v2/Vatfunc.php",
                      "line": 10,
                      "reason": "Actual Vatfunc hook; Permissionfunc same-named method is not dispatched.",
                      "sha256": "3d8cef71f39ce3b4cc04f2adc95b8ee0f8d490983db2d55e1f6ec6445a2c63ee"
                    },
                    {
                      "file": "application/models/v2/Vatfunc.php",
                      "line": 40,
                      "reason": "POST before-insert default behavior; no update validation call.",
                      "sha256": "3d8cef71f39ce3b4cc04f2adc95b8ee0f8d490983db2d55e1f6ec6445a2c63ee"
                    },
                    {
                      "file": "application/models/v2/Vatfunc.php",
                      "line": 80,
                      "reason": "Raw-truthiness validation forbids removal/deactivation of current default and status=false with default=true.",
                      "sha256": "3d8cef71f39ce3b4cc04f2adc95b8ee0f8d490983db2d55e1f6ec6445a2c63ee"
                    },
                    {
                      "file": "docs/openapi/reviews/payment-fields.json",
                      "line": 1,
                      "reason": "Independent field-level source review, direction applicability, examples and explicit runtime limitations.",
                      "sha256": "4a3097e873943fa5090a2fd52086762dc36a50d399bdd78ad6b20e6ed595639a"
                    },
                    {
                      "file": "application/models/v2/Vatfunc.php",
                      "line": 58,
                      "lineEnd": 70,
                      "reason": "Every update resolves the VAT row by id and firma_info_id; missing or foreign rows throw ED80100 before default-clearing writes.",
                      "sha256": "3d8cef71f39ce3b4cc04f2adc95b8ee0f8d490983db2d55e1f6ec6445a2c63ee"
                    },
                    {
                      "file": "application/models/v2/Vatfunc.php",
                      "line": 72,
                      "lineEnd": 78,
                      "reason": "Both field hooks merge the same aktiv value: nonzero integer default activates; otherwise supplied integer status wins; otherwise existing activity remains. JSON key order cannot restore the old activity.",
                      "sha256": "3d8cef71f39ce3b4cc04f2adc95b8ee0f8d490983db2d55e1f6ec6445a2c63ee"
                    }
                  ]
                },
                "last_change": {
                  "description": "Client value ignored; server time used, including update_default injection when absent.",
                  "x-edoobox-schemaStatus": "source-reviewed",
                  "x-edoobox-ignoredInput": true,
                  "examples": [
                    "2001-01-01T00:00:00Z",
                    null
                  ],
                  "x-edoobox-contractSource": [
                    {
                      "file": "application/models/v2/Vat.php",
                      "line": 120,
                      "reason": "Exact Structure declaration: get converts incoming wire input; set converts response output.",
                      "sha256": "e1cdb6c7a92dd3e1fe2fb08e96946d3a70502cbc1d12fa7b572eae1d170f0eef"
                    },
                    {
                      "file": "application/models/v2/Vat.php",
                      "line": 152,
                      "reason": "Exact POST/PUT callers use API_DATA and Modal Vat.",
                      "sha256": "e1cdb6c7a92dd3e1fe2fb08e96946d3a70502cbc1d12fa7b572eae1d170f0eef"
                    },
                    {
                      "file": "application/models/v2/API_DATA.php",
                      "line": 1278,
                      "reason": "Single POST injects absent insert_default as 0, executes incoming getters (not update func) and calls before-insert hook.",
                      "sha256": "c0e15d26a7a4f3fb3c25e35557d4420ad395b2af3925caec292de08e32ebf44c"
                    },
                    {
                      "file": "application/models/v2/API_DATA.php",
                      "line": 1779,
                      "reason": "PUT injects update_default when absent.",
                      "sha256": "c0e15d26a7a4f3fb3c25e35557d4420ad395b2af3925caec292de08e32ebf44c"
                    },
                    {
                      "file": "application/models/v2/API_DATA.php",
                      "line": 1568,
                      "reason": "Batch POST only processes supplied values.",
                      "sha256": "c0e15d26a7a4f3fb3c25e35557d4420ad395b2af3925caec292de08e32ebf44c"
                    },
                    {
                      "file": "application/helpers/edooboxhelp_helper.php",
                      "line": 11629,
                      "reason": "Actual dQ date-time/false output.",
                      "sha256": "090d351b5bde81813c7a829bedf2f1f9f978fce5765f246989779f996198934e"
                    },
                    {
                      "file": "docs/openapi/reviews/payment-fields.json",
                      "line": 1,
                      "reason": "Independent field-level source review, direction applicability, examples and explicit runtime limitations.",
                      "sha256": "4a3097e873943fa5090a2fd52086762dc36a50d399bdd78ad6b20e6ed595639a"
                    }
                  ]
                }
              },
              "additionalProperties": true,
              "description": "Source-declared fields; action-specific and account validation still apply.",
              "minProperties": 1,
              "x-edoobox-readOnlyFields": [],
              "x-edoobox-clientRestriction": "Read-only fields are forbidden by this client contract to prevent silently ignored writes; the legacy API itself skips them. Explicit source-marked update context fields remain accepted for hook validation without changing their immutable database columns."
            },
            "id": {
              "type": "string",
              "pattern": "^[a-z0-9]+_[a-f0-9]{12}_-?[0-9]+$",
              "description": "Opaque edoobox v2 object ID returned by this account. Never send a raw database ID. The synthetic example is illustrative and is not a real record.",
              "examples": [
                "vat_012345abcdef_123456"
              ]
            }
          },
          "additionalProperties": true,
          "required": [
            "data",
            "id"
          ]
        },
        "examples": {
          "request": {
            "summary": "Mehrwertsteuersatz aktualisieren",
            "value": {
              "data": {
                "description": "Aktualisierter Normalsatz",
                "status": true
              },
              "id": "vat_012345abcdef_123456"
            }
          }
        }
      }
    }
  },
  "x-edoobox-runtimeMutationGuard": true,
  "x-edoobox-documentationReview": {
    "file": "docs/openapi/operation-contracts/04-accounting.json",
    "notes": []
  },
  "x-edoobox-source": {
    "file": "application/models/v2/Vat.php",
    "method": "updateVat",
    "line": 171
  },
  "x-edoobox-documentationStatus": "reviewed",
  "x-edoobox-readOnly": false,
  "x-edoobox-safeForAutomation": false,
  "x-edoobox-permission": {
    "resource": "vat",
    "short": "vat",
    "checkedByDispatcher": true,
    "levels": [
      3,
      4
    ],
    "description": "Resource permission mapping from APIPermissions(), Authfunc::_getCheckJWT. Additional model/admin/plugin checks may apply; resources absent from api_permission do not acquire a fictitious scope."
  }
}
```