---
title: "Update an existing priority"
method: PATCH
path: "/priorities/{id}"
tags: ["Priorities"]
---

# Update an existing priority

`PATCH /priorities/{id}`

Performs a **partial update** on the specified priority using **JSON Merge Patch** semantics (RFC 7396). Only fields provided in the payload are modified; omitted fields remain unchanged.

Immutable fields like `id`, `testingToken`, `createdAt`, and `updatedAt` are ignored if included. `startAt` and `endAt` can be updated independently. For nested objects like `preAdmission`, the entire object is replaced, not merged.

## Path parameters

- `id` string, uuid, required

## Response `200`

Successfully updated priority.

- Priority
  - `id` string, uuid, required — System-generated unique identifier for the priority.
  - `name` string, required — Descriptive name of the priority, used for identification in the dashboard and API. Not shown to end users.
  - `maximumConcurrentVisitors` integer, required — Maximum number of concurrent visitors allowed on your website before new visitors are placed in the waiting room.
  - `inactivityTimeoutMinutes` integer, required — How long a visitor can be inactive before their session expires. Every interaction matching the waiting room scope will automatically reset this countdown. Must be between 10 and 30 minutes.
  - `admissionRatePerMinute` integer, required — Maximum number of visitors allowed to leave the waiting room and access the website each minute. This smooths traffic bursts and prevents thundering herd effects when the queue opens.
  - `priority` integer — Determines order of evaluation when multiple priorities could apply. Lower values take precedence.
  - `matchingCondition` string, required — Boolean expression defining which traffic is sent to this priority. Uses DataDome Lucene syntax with `AND`, `OR`, `NOT` operators and `field:value` matching. **Examples:** - `domain:www.example.com AND url:/product/*` - `domain:*` - `(countrycode:US OR countrycode:CA) AND url:/sale` - `domain:shop.example.com AND NOT method:GET`
  - `preAdmission` PreAdmission — Pre-admission configuration. If `durationMinutes` is greater than 0, the pre-admission is active and opens that many minutes before `startAt`. If `durationMinutes` is 0, no pre-admission is used.
    - `durationMinutes` integer — Number of minutes before `startAt` when the pre-admission opens. Set to 0 to disable the pre-admission.
  - `startAt` string, date-time, nullable — UTC timestamp when the priority becomes active (inclusive). ISO 8601 format.
  - `endAt` string, date-time, nullable — UTC timestamp when the priority expires and stops accepting visitors (exclusive). ISO 8601 format.
  - `enforceClientSideValidation` boolean — When `true`, visitors passing through the queue must successfully execute client-side validation logic in their browser before being granted access to the protected website.
  - `allowAIAgent` boolean — When `true`, known AI or automated agents are allowed to bypass the waiting room.
  - `directAccessTrafficType` string[], required — Traffic categories allowed to skip the waiting room entirely. Subset of `verifiedBots`, `customRules`. An empty array means no category bypasses. **POST:** optional; `[]`, `["verifiedBots"]`, `["customRules"]` or `["verifiedBots","customRules"]` are accepted. Omitted defaults to `[]`. Explicit `null` or unknown values return `400`. **PATCH:** omit the field to leave the current set untouched. Provide `[]` to clear it or a subset to replace it. `null` returns `400`.
  - `isEnabled` boolean, required — When `true`, the priority is active and is triggered if configuration conditions are met. When `false`, the priority is never triggered.
  - `template` TemplateEmbed — Embedded template summary returned inside a priority response.
    - `id` string, uuid — Unique identifier of the template.
    - `name` string — Name of the template.
  - `testingToken` string, uuid — Token that allows testing this priority for debugging or privileged access. Automatically generated at creation time and cannot be modified. **Security note:** This is a sensitive secret. Only returned when `includeTestingToken=true` is explicitly provided on GET requests.
  - `createdAt` string, date-time, required — Timestamp when the priority was created (ISO 8601 UTC).
  - `updatedAt` string, date-time, required — Timestamp when the priority configuration was last updated (ISO 8601 UTC).

## Other responses

- `400` — Bad request - malformed JSON or invalid field types.
- `401` — Unauthorized - missing or invalid API key.
- `403` — Forbidden. The provided API key is valid, but the user does not have sufficient permissions to perform this operation.
- `404` — Resource not found.
- `422` — Unprocessable entity - validation failure. Examples: a required field missing (`name`, `admissionRatePerMinute`, `matchingCondition`), a field value outside its documented range (e.g. `inactivityTimeoutMinutes` outside 10-30), an invalid `directAccessTrafficType` value, `startAt >= endAt`, invalid matching condition syntax, duplicate priority value.

---

[API](https://skmtc.net/datadome/apis/protection-api.md) · [All operations](https://skmtc.net/datadome/apis/protection-api/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/datadome/protection-api/revisions/2576052958eb/schema)