# Update and resubmit an employee advance request

Operation ID: `updateEmployeeAdvanceRequest`

Group: Accounting › Employee Advances

[Open in the interactive reference](https://docs.api.lensing.ai/lensing/v1/endpoints/updateEmployeeAdvanceRequest)

`PATCH /accounting/employee-advances/{id}`

Retry-safe: A write that accepts Idempotency-Key: repeating a request with the same key replays the stored answer instead of executing twice.

Updates and resubmits an employee advance request. Use the request's id, not its advanceRequestNumber. This replaces the whole advance request. categoryId, amount, and purpose are required.

A field you leave out goes back to its default: tripStart, tripEnd, and notes are cleared. attachments works differently: leave it out to keep the current attachments. An attachments list you send replaces the whole list, so include every attachment you want to keep.

The request's status returns to 'pendingApproval', and any approval progress is reset.

Only the employee who made the request can change it. For anyone else, the update fails with NOT_OWNER.

A request in 'draft', 'pendingApproval', or 'rejected' can be changed. An 'approved' or 'issued' request can't, and the update fails with NOT_EDITABLE.

The response is empty. The resubmitted request can already be approved by the time the response arrives, so read its status with GET accounting/employee-advances/:id.

## Parameters

| Name | In | Type | Required | Description |
| --- | --- | --- | --- | --- |
| `Api-Version` | header | string · v1 | yes | The API version this request targets, named by its public identifier. Required on every request; omitting it, or naming a version this company does not have, is answered with 400. This document describes version `v1`. |
| `Idempotency-Key` | header | string | no | An opaque caller-chosen string (1-255 characters) that makes this request safe to retry. Repeating the same key with an identical request body replays the original response instead of re-executing - but only once that original request succeeded; a failed attempt re-executes on retry. Repeating the key with a different body is answered with 422. A key still in flight is answered with 409 - as is a key whose original request was interrupted before it finished, for a few minutes afterwards, until that attempt is presumed dead. A completed response stays replayable for 24 hours. The key is scoped to the caller, not to the action: reusing it for a different action is answered with 409 or 422 rather than treated independently. On read actions this header is ignored. On write actions that cannot offer the guarantee it is answered with `400 IDEMPOTENCY_NOT_SUPPORTED` rather than silently ignored. |
| `id` | path | string | yes | Id (a UUID) of the advance request to update. Example: `"b81f4a22-6d90-4c53-8e17-9f2a4b6c8d05"`. |

## Request body

Required, `application/json`: updateEmployeeAdvanceRequestInput.

| Field | Type | Required | Description |
| --- | --- | --- | --- |
| `categoryId` | string | yes | Id (a UUID) of the AdvancePaymentCategory this request draws from. Must belong to the calling employee's own entity. Example: `"5c8e2f14-9a3b-4d67-8e21-1b4c6a9d3e02"`. |
| `amount` | decimal | yes | Requested amount, in the calling employee's entity functional currency. Must be greater than zero. Stored as the request's single purpose line. Example: `"900.00"`. |
| `purpose` | string | yes | What the advance is for. Required, non-blank. Stored as the request's single purpose line. Example: `"Client site visit — flights, hotel and ground transport"`. |
| `tripStart` | date | no | First day of the trip the advance covers. Optional. |
| `tripEnd` | date | no | Last day of the trip the advance covers. Must not be before tripStart. Optional. |
| `notes` | string | no | Free-text notes from the requester. Optional. |
| `attachments` | array<object> | no | Files to attach to the request. Replaces the stored set entirely (this is a full replace, not a partial patch). A tenant may require at least one; see ATTACHMENT_REQUIRED. Example: `[{"fileName":"itinerary.pdf","fileId":"3f9c1e2a-7b4d-4e6f-9a1c-2d5e8f0b6c3a"}]`. |
| `attachments[].fileName` | string | yes | Display name of the attached file. |
| `attachments[].fileId` | string | yes | Id of the already-uploaded file. |

```json
{
  "categoryId": "5c8e2f14-9a3b-4d67-8e21-1b4c6a9d3e02",
  "amount": "900.00",
  "purpose": "Client site visit — flights, hotel and ground transport",
  "tripStart": "2026-01-15",
  "tripEnd": "2026-01-15",
  "notes": "<notes>",
  "attachments": [
    {
      "fileName": "itinerary.pdf",
      "fileId": "3f9c1e2a-7b4d-4e6f-9a1c-2d5e8f0b6c3a"
    }
  ]
}
```

## Response

`200` Success

```json
{
  "data": {},
  "diagnostics": [
    {
      "code": "<code>",
      "message": "<message>",
      "severity": "error",
      "path": [
        "<path>"
      ],
      "details": "<details>"
    }
  ]
}
```

## Response headers

- `Idempotency-Replayed` — Present and `true` only when this response replays a previously stored one for the same Idempotency-Key, rather than reflecting a live execution. Absent on a live response - never sent as `false`.

## Errors

| Code | Status |
| --- | --- |
| `REQUEST_NOT_FOUND` | 400 |
| `NOT_OWNER` | 400 |
| `NOT_EDITABLE` | 400 |
| `CATEGORY_NOT_FOUND` | 400 |
| `CATEGORY_WRONG_ENTITY` | 400 |
| `NO_FUNCTIONAL_CURRENCY` | 400 |
| `INVALID_AMOUNT` | 400 |
| `MISSING_PURPOSE` | 400 |
| `PURPOSE_NOT_FOUND` | 400 |
| `INVALID_TRIP_DATES` | 400 |
| `ATTACHMENT_REQUIRED` | 400 |
| `ADVANCE_LIMIT_EXCEEDED` | 400 |
| `UNEXPECTED_ERROR` | 400 |
| `IDEMPOTENCY_KEY_CONFLICT` | 409 |
| `IDEMPOTENCY_PAYLOAD_MISMATCH` | 422 |

## Statuses

- `400` — Invalid request or business failure. Codes: REQUEST_NOT_FOUND, NOT_OWNER, NOT_EDITABLE, CATEGORY_NOT_FOUND, CATEGORY_WRONG_ENTITY, NO_FUNCTIONAL_CURRENCY, INVALID_AMOUNT, MISSING_PURPOSE, PURPOSE_NOT_FOUND, INVALID_TRIP_DATES, ATTACHMENT_REQUIRED, ADVANCE_LIMIT_EXCEEDED, UNEXPECTED_ERROR
- `401` — The request carries no valid access token.
- `403` — Not authorized
- `404` — Not found
- `409` — The Idempotency-Key is still being processed by another request.
- `422` — The Idempotency-Key was already used with a different request payload.
- `429` — Too many requests from this client address. The response has no body and no `Retry-After` header.
- `500` — Internal server error