> ## Documentation Index
> Fetch the complete documentation index at: https://docs.hopae.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Update App

> Partially update an app's configuration.

Partially updates an app. All body fields are optional — supply only what you want to change.

<Warning>
  **Immutable fields:** `clientId` and `clientSecret` cannot be changed via this endpoint. Attempts
  to include either field in the PATCH body will return `400 VALIDATION_INVALID_PARAMETER`. To
  rotate the client secret, use
  [POST /apps/\{client\_id}/rotate-client-secret](/api-reference/workspace/rotate-client-secret).
</Warning>

## Request

<ParamField header="Authorization" type="string" required>
  `Bearer <API_KEY>` from Console > Developers > Workspace API Keys.
</ParamField>

<ParamField header="Content-Type" type="string">
  `application/json`
</ParamField>

### Path parameters

<ParamField path="client_id" type="string" required>
  Client identifier of the app.
</ParamField>

### Request body

<ParamField body="name" type="string">
  New display name for the app.
</ParamField>

<ParamField body="redirectUris" type="string[]">
  Replaces the full list of allowed OAuth redirect URIs. Pass an empty array to clear all URIs.
</ParamField>

<ParamField body="webhookConfig" type="object">
  Partial webhook configuration. Merges with the existing config — fields you omit are preserved.

  <Expandable title="webhookConfig fields">
    <ParamField body="webhookConfig.enabled" type="boolean">
      Enable or disable webhook delivery.
    </ParamField>

    <ParamField body="webhookConfig.url" type="string">
      HTTPS endpoint that receives webhook events.
    </ParamField>

    <ParamField body="webhookConfig.retryAttempts" type="number">
      Number of delivery retries on failure (default: 3).
    </ParamField>

    <ParamField body="webhookConfig.timeoutSeconds" type="number">
      Per-attempt timeout in seconds (default: 10).
    </ParamField>

    <ParamField body="webhookConfig.events" type="string[]">
      Event types to subscribe to. Pass an empty array to receive all events.
    </ParamField>
  </Expandable>
</ParamField>

<ParamField body="defaultSuccessRedirectUri" type="string">
  URI users are redirected to after a successful verification when no `redirect_uri` was supplied at session start.
</ParamField>

<ParamField body="defaultFailureRedirectUri" type="string">
  URI users are redirected to after a failed or cancelled verification when no `redirect_uri` was supplied at session start.
</ParamField>

## Response

Returns the updated App object.

<RequestExample>
  ```bash theme={null}
  curl -X PATCH \
    -H "Authorization: Bearer sk_workspace_test_..." \
    -H "Content-Type: application/json" \
    -d '{
      "name": "New App Name",
      "redirectUris": ["https://app.example.com/callback"],
      "defaultSuccessRedirectUri": "https://app.example.com/success",
      "defaultFailureRedirectUri": "https://app.example.com/error"
    }' \
    "https://sandbox.api.hopae.com/connect/v1/apps/HqTRDIYH"
  ```
</RequestExample>

<ResponseExample>
  ```json theme={null}
  {
    "clientId": "HqTRDIYH",
    "clientSecret": "sh_app_...",
    "name": "New App Name",
    "redirectUris": ["https://app.example.com/callback"],
    "providers": {
      "passport": { "enabled": true },
      "smartid": { "enabled": true, "config": { "useManagedCredentials": false, "rpUUID": "d278d410-...", "rpName": "Example" } },
      "mitid": { "enabled": false }
    },
    "defaultWorkflowId": "wf_6ec9b183",
    "workflows": [
      {
        "workflowId": "wf_6ec9b183",
        "name": "Default",
        "entryNodeId": "nd_231bba48",
        "nodes": [
          { "id": "nd_231bba48", "type": "request", "next": "nd_8fa2291e" },
          { "id": "nd_8fa2291e", "type": "verification", "next": "nd_9ea348df", "config": { "channel": "oidc", "claims": ["name", "given_name", "family_name", "birthdate"], "mode": "pii" } },
          { "id": "nd_9ea348df", "type": "response" }
        ],
        "createdAt": "2026-03-27T08:22:51.272Z",
        "updatedAt": "2026-03-27T08:22:51.272Z"
      }
    ],
    "organizationId": "org_...",
    "webhookConfig": {
      "enabled": false,
      "retryAttempts": 3,
      "timeoutSeconds": 10,
      "events": []
    }
  }
  ```
</ResponseExample>

<Info>
  Only <code>name</code> (and related fields such as <code>redirectUris</code>, <code>webhookConfig</code>, and default redirect URIs) can be updated via PATCH. Sending <code>clientId</code> or <code>clientSecret</code> in the body returns <code>400 VALIDATION\_INVALID\_PARAMETER</code>.
</Info>