---
title: "Update Function"
method: POST
path: "/api/v1/functions/update"
tags: ["Function"]
---

# Update Function

`POST /api/v1/functions/update`

Update updates an existing function's metadata

## Request body

- C1ApiFunctionsV1FunctionsServiceUpdateFunctionRequest — The FunctionsServiceUpdateFunctionRequest message.
  - `function` C1ApiFunctionsV1Function — Function represents a customer-provided code extension in the API
    - `createdAt` string, date-time
    - `deletedAt` string, date-time
    - `description` string — The description field.
    - `displayName` string — The displayName field.
    - `functionType` 'FUNCTION_TYPE_UNSPECIFIED' | 'FUNCTION_TYPE_ANY' | 'FUNCTION_TYPE_CODE_MODE' — The functionType field.
    - `head` string — The head field.
    - `id` string — The id field.
    - `isDraft` boolean — The isDraft field.
    - `outboundNetworkAllowlist` string[], nullable — The outboundNetworkAllowlist field.
    - `publishedCommitId` string — The publishedCommitId field.
    - `scopedRoleIds` string[], nullable — Scoped role IDs define the permissions granted to this function when calling ConductorOne APIs. These are role IDs (not service roles) that get resolved to their service roles at authentication time. Currently only the "Read-Only Administrator" role (system:viewer) is supported. The role ID can be obtained from the roles API.
    - `secret` object — The secret field.
    - `updatedAt` string, date-time
    - `useSpn` boolean — FN-347 transition flag. When true, the function authenticates to c1-api as user:<sp_id> via the AssumeIdentity token exchange using its ServicePrincipalBinding; when false, it authenticates as function:<id>. Read-only from clients: set by CreateFunction (when the tenant has completed the FunctionsToSPN migration) and by the migration itself, never by UpdateFunction. Retired once all functions are on SPN.
  - `updateMask` string, nullable

## Response `200`

Successful response

- C1ApiFunctionsV1FunctionsServiceUpdateFunctionResponse — The FunctionsServiceUpdateFunctionResponse message.
  - `function` C1ApiFunctionsV1Function — Function represents a customer-provided code extension in the API
    - `createdAt` string, date-time
    - `deletedAt` string, date-time
    - `description` string — The description field.
    - `displayName` string — The displayName field.
    - `functionType` 'FUNCTION_TYPE_UNSPECIFIED' | 'FUNCTION_TYPE_ANY' | 'FUNCTION_TYPE_CODE_MODE' — The functionType field.
    - `head` string — The head field.
    - `id` string — The id field.
    - `isDraft` boolean — The isDraft field.
    - `outboundNetworkAllowlist` string[], nullable — The outboundNetworkAllowlist field.
    - `publishedCommitId` string — The publishedCommitId field.
    - `scopedRoleIds` string[], nullable — Scoped role IDs define the permissions granted to this function when calling ConductorOne APIs. These are role IDs (not service roles) that get resolved to their service roles at authentication time. Currently only the "Read-Only Administrator" role (system:viewer) is supported. The role ID can be obtained from the roles API.
    - `secret` object — The secret field.
    - `updatedAt` string, date-time
    - `useSpn` boolean — FN-347 transition flag. When true, the function authenticates to c1-api as user:<sp_id> via the AssumeIdentity token exchange using its ServicePrincipalBinding; when false, it authenticates as function:<id>. Read-only from clients: set by CreateFunction (when the tenant has completed the FunctionsToSPN migration) and by the migration itself, never by UpdateFunction. Retired once all functions are on SPN.

---

[API](https://skmtc.net/conductorone/apis/c1-api.md) · [All operations](https://skmtc.net/conductorone/apis/c1-api/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/conductorone/c1-api/versions/d391405a35d3/schema)