---
title: "Update an application"
method: PATCH
path: "/api/v1/applications/{id}"
tags: ["applications"]
---

# Update an application

`PATCH /api/v1/applications/{id}`

Updates an application's top-level attributes. Supports optimistic locking: include the current `lock_version` to guard against concurrent edits, which returns a conflict if the application has changed since you read it. To modify resources and permissions, use the update-structure endpoint.

## Path parameters

- `id` string, required

## Headers

- `Idempotency-Key` string

## Request body

- UpdateApplication — Request body for updating an application's scalar fields. Reject keys: resources, permissions, policy_ids.
  - `admin_user_ids` string[] — User IDs of the application's admins. Send [] to clear; unknown IDs return 422.
  - `auth_method` 'google' | 'microsoft' | 'okta' | 'sso_provider' | 'credentials' | 'other', nullable — Authentication method used to sign in
  - `data_location` string, nullable — Where the vendor stores data
  - `description` string, nullable
  - `last_vendor_review_at` string, date, nullable — Date of the last vendor security review
  - `lock_version` integer — Optimistic lock version. Optional; if stale, returns 409.
  - `mfa_activated` boolean, nullable — Whether MFA is activated for this application
  - `notes` string, nullable — Internal notes
  - `owner_user_id` string, uuid, nullable
  - `processed_data_types` string[] — Data-processing-scope slugs. Send [] to clear; unknown slugs return 422.
  - `risk_level` 'low' | 'medium' | 'high', nullable
  - `status` 'ignored' | 'approved' | 'requestable' — Needs a set owner for "approved" and "requestable"
  - `tags` string[] — Tag titles. New titles are created automatically; send [] to clear.
  - `title` string
  - `url` string, nullable
  - `user_setup_url` string, nullable — URL where existing users are shown and new users are invited
  - `vendor_certificates` string[] — Security/compliance certifications held by the vendor

## Response `200`

Application

- Application — An application in the organization
  - `admin_user_ids` string[] — User IDs of the application's admins
  - `auth_method` 'google' | 'microsoft' | 'okta' | 'sso_provider' | 'credentials' | 'other', nullable — Authentication method used to sign in
  - `data_location` string, nullable — Where the vendor stores data
  - `description` string, nullable — Description
  - `id` string, uuid, required — Application ID
  - `inserted_at` string, date-time — Creation timestamp
  - `last_vendor_review_at` string, date, nullable — Date of the last vendor security review
  - `mfa_activated` boolean, nullable — Whether MFA is activated for this application
  - `notes` string, nullable — Internal notes
  - `owner_user_id` string, uuid, nullable — Owner user ID
  - `permanent_access_allowed` boolean — Whether the application allows permanent (non-expiring) access
  - `processed_data_types` string[] — Types of data this application processes
  - `provisioning_type` 'application_admin' | 'automatic' — Provisioning type
  - `risk_level` 'low' | 'medium' | 'high', nullable — Risk level assessment
  - `status` 'ignored' | 'discovered' | 'approved' | 'requestable', required — Application status
  - `tags` object[] — Tags assigned to this application
    - `id` string, uuid
    - `title` string
  - `time_based_access_durations` string[] — Configured time-based access durations as ISO 8601 durations (e.g. "PT1H", "P7D"); empty when the app offers only permanent access
  - `title` string, required — Application title
  - `updated_at` string, date-time — Last update timestamp
  - `url` string, nullable — Application URL
  - `user_count` integer, nullable — Number of users with access
  - `user_setup_url` string, nullable — URL where existing users are shown and new users are invited
  - `vendor_certificates` string[] — Security/compliance certifications held by the vendor

## Other responses

- `400` — Bad request
- `401` — Unauthorized
- `403` — Forbidden
- `404` — Not found
- `409` — Stale entry
- `422` — Validation error

---

[API](https://skmtc.net/accessowl/apis/accessowl-api.md) · [All operations](https://skmtc.net/accessowl/apis/accessowl-api/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/accessowl/accessowl-api/versions/f01f507d4b4e/schema)