---
title: "Update Function"
method: POST
path: "/api/v1/functions/update"
tags: ["Function"]
---

# Update Function

`POST /api/v1/functions/update`

Update an existing function's metadata, code, or both. Also the publish
 path: set function.published_commit_id and include "published_commit_id"
 in update_mask to make a commit the default runnable version. To push a
 new code commit, set content (and optionally commit_message); this is
 independent of update_mask, since commits are versioned separately from
 function metadata. A single request cannot publish the commit it just
 created, since published_commit_id is validated against existing commits
 before content is committed: publishing new code takes two calls, push
 then publish with the returned commit.id.

## Request body

- C1ApiFunctionsV1FunctionsServiceUpdateFunctionRequest — The FunctionsServiceUpdateFunctionRequest message.
  - `commitMessage` string — The commit message describing this code update. Defaults to a generic message if content is set and this is empty. Ignored if content is empty.
  - `content` object — File map for a new code commit, applied as the function's new head commit. Keys are file paths in the function root; values are file contents as bytes. See CreateFunctionRequest.initial_content for the required entry-file signature. Independent of update_mask.
  - `function` C1ApiFunctionsV1Function — Function represents a customer-provided code extension in the API
    - `createdAt` string, date-time, nullable
    - `deletedAt` string, date-time, nullable
    - `description` string — The description field.
    - `displayName` string — The displayName field.
    - `functionType` 'FUNCTION_TYPE_UNSPECIFIED' | 'FUNCTION_TYPE_ANY' | 'FUNCTION_TYPE_CODE_MODE' — The functionType field.
    - `head` string — The head field.
    - `hookRefs` string[], nullable — IDs of every non-deleted hook that still references this function. Read-only: maintained by the Hook API, not by CreateFunction/UpdateFunction. Non-empty means DeleteFunction will refuse to delete until these are removed or retargeted.
    - `id` string — The id field.
    - `isDraft` boolean — The isDraft field.
    - `outboundNetworkAllowlist` string[], nullable — The outboundNetworkAllowlist field.
    - `provisionedConcurrency` integer — Number of pre-warmed Lambda instances. 0 (default) leaves the function cold-started on first invoke. > 0 reserves and provisions that many execution environments via AWS Lambda provisioned concurrency. Ignored for FUNCTION_TYPE_CODE_MODE functions — that value is driven by AIGovernanceSettings.code_mode_concurrency.
    - `publishedCommitId` string — The publishedCommitId field.
    - `scopedRoleIds` string[], nullable — Scoped role IDs define the permissions granted to this function when calling ConductorOne APIs. These are role IDs (not service roles) that get resolved to their service roles at authentication time. Currently only the "Read-Only Administrator" role (system:viewer) is supported. The role ID can be obtained from the roles API.
    - `secret` object — The secret field.
    - `updatedAt` string, date-time, nullable
    - `useSpn` boolean — FN-347 transition flag. When true, the function authenticates to c1-api as user:<sp_id> via the AssumeIdentity token exchange using its ServicePrincipalBinding; when false, it authenticates as function:<id>. Read-only from clients: set by CreateFunction (when the tenant has completed the FunctionsToSPN migration) and by the migration itself, never by UpdateFunction. Retired once all functions are on SPN.
    - `workflowTemplateRefs` string[], nullable — IDs of every non-deleted workflow template whose CallFunction step still references this function. Read-only, same semantics as hook_refs.
  - `updateMask` string, nullable

## Response `200`

Successful response

- C1ApiFunctionsV1FunctionsServiceUpdateFunctionResponse — The FunctionsServiceUpdateFunctionResponse message.
  - `commit` C1ApiFunctionsV1FunctionCommit — FunctionCommit represents a single commit in a function's history
    - `author` string — The author field.
    - `createdAt` string, date-time, nullable
    - `functionId` string — The functionId field.
    - `id` string — The id field.
    - `message` string — The message field.
  - `function` C1ApiFunctionsV1Function — Function represents a customer-provided code extension in the API
    - `createdAt` string, date-time, nullable
    - `deletedAt` string, date-time, nullable
    - `description` string — The description field.
    - `displayName` string — The displayName field.
    - `functionType` 'FUNCTION_TYPE_UNSPECIFIED' | 'FUNCTION_TYPE_ANY' | 'FUNCTION_TYPE_CODE_MODE' — The functionType field.
    - `head` string — The head field.
    - `hookRefs` string[], nullable — IDs of every non-deleted hook that still references this function. Read-only: maintained by the Hook API, not by CreateFunction/UpdateFunction. Non-empty means DeleteFunction will refuse to delete until these are removed or retargeted.
    - `id` string — The id field.
    - `isDraft` boolean — The isDraft field.
    - `outboundNetworkAllowlist` string[], nullable — The outboundNetworkAllowlist field.
    - `provisionedConcurrency` integer — Number of pre-warmed Lambda instances. 0 (default) leaves the function cold-started on first invoke. > 0 reserves and provisions that many execution environments via AWS Lambda provisioned concurrency. Ignored for FUNCTION_TYPE_CODE_MODE functions — that value is driven by AIGovernanceSettings.code_mode_concurrency.
    - `publishedCommitId` string — The publishedCommitId field.
    - `scopedRoleIds` string[], nullable — Scoped role IDs define the permissions granted to this function when calling ConductorOne APIs. These are role IDs (not service roles) that get resolved to their service roles at authentication time. Currently only the "Read-Only Administrator" role (system:viewer) is supported. The role ID can be obtained from the roles API.
    - `secret` object — The secret field.
    - `updatedAt` string, date-time, nullable
    - `useSpn` boolean — FN-347 transition flag. When true, the function authenticates to c1-api as user:<sp_id> via the AssumeIdentity token exchange using its ServicePrincipalBinding; when false, it authenticates as function:<id>. Read-only from clients: set by CreateFunction (when the tenant has completed the FunctionsToSPN migration) and by the migration itself, never by UpdateFunction. Retired once all functions are on SPN.
    - `workflowTemplateRefs` string[], nullable — IDs of every non-deleted workflow template whose CallFunction step still references this function. Read-only, same semantics as hook_refs.

---

[API](https://skmtc.net/conductorone/apis/c1-api.md) · [All operations](https://skmtc.net/conductorone/apis/c1-api/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/conductorone/c1-api/revisions/f2cf3228f366/schema)