Locking company fields

If your platform is the source of truth for a company's legal name, trade name, legal address, or federal EIN, you can lock those fields in the Components you embed. A locked field shows its value, but the user can't edit it in the Component. To lock fields, pass field_permissions in the request body when you create the link.

These Components apply field_permissions:

• Company details
• Company business details
• Company full service setup submission
• Company tax setup, which renders the federal EIN
• Company onboard, in its company details and tax setup steps

Create a link with locked fields

To lock a field, set its key to read in the field_permissions map. This request creates a Company details link with all four fields locked:

curl -X POST https://api.checkhq.com/companies/{company_id}/components/details \
  -H "Authorization: Bearer {api_key}" \
  -H "Content-Type: application/json" \
  -d '{
    "signer_name": "Jane Doe",
    "signer_title": "Owner",
    "email": "[email protected]",
    "field_permissions": {
      "company:legal_name": "read",
      "company:trade_name": "read",
      "company:address": "read",
      "company_tax_param:federal_ein": "read"
    }
  }'

Check writes the locks into the link it returns, as a field_permissions query parameter. Open that link as you would any other. Appearance settings and the SDK work the same way, as described in Customizing Components.

A Component ignores keys for fields it doesn't render. Company details has no federal EIN field, so it ignores company_tax_param:federal_ein in the example. You can send the same map on every link you create for a company.

Lockable fields

Each key takes one of two access levels:

A key you leave out of the map stays editable. The request returns a 400 error if the map contains a key that isn't in the lockable fields table, or a level other than read or read_write.

What the user sees

A locked field is disabled. When the user hovers over it, a tooltip reads "This field is not editable."

The Component also changes how it saves and navigates:

• When the user saves a form, the Component leaves locked fields out of the update it sends to Check.
• On the business name and business address screens, if every field on the screen is locked, Continue moves to the next screen without saving.
• In a review section where every field is locked, the edit button is hidden.
• A locked federal EIN shows in read mode, and its Edit button is disabled.

Lock a field only after the company has a value for it. A locked field with no value shows as empty, and the user can't fill it in. For the federal EIN, the tax setup Component doesn't let the user continue past the federal page until the EIN has a value.

Locks apply to the Component UI only

field_permissions controls what the Component lets the user edit. It isn't access control in the Check API:

• The Check API doesn't reject writes to a locked field. A request made with your API key, or by any other client with access to the company, can still change it.
• The lock travels as a query parameter on the link. Anyone who holds the link can remove that parameter before opening it, and the Component then shows the fields as editable.

Keep your own check that Check's values match your records. To catch a change to the legal name, trade name, or legal address, subscribe to company events. To check the federal EIN, read it with List company tax parameters.