---
title: "Update"
method: PATCH
path: "/edges/tls/{id}"
tags: ["EdgesTLS"]
---

# Update

`PATCH /edges/tls/{id}`

Updates a TLS Edge by ID. If a module is not specified in the update, it will not be modified. However, each module configuration that is specified will completely replace the existing value. There is no way to delete an existing module via this API, instead use the delete module API.

## Path parameters

- `id` string, required

## Headers

- `ngrok-version` integer, required

## Request body

- TLSEdgeUpdate
  - `id` string — unique identifier of this edge
  - `description` string — human-readable description of what this edge will be used for; optional, max 255 bytes.
  - `metadata` string — arbitrary user-defined machine-readable data of this edge. Optional, max 4096 bytes.
  - `hostports` string[] — hostports served by this edge
  - `backend` EndpointBackendMutate
    - `enabled` boolean — `true` if the module will be applied to traffic, `false` to disable. default `true` if unspecified
    - `backend_id` string — backend to be used to back this endpoint
  - `ip_restriction` EndpointIPPolicyMutate
    - `enabled` boolean — `true` if the module will be applied to traffic, `false` to disable. default `true` if unspecified
    - `ip_policy_ids` string[] — list of all IP policies that will be used to check if a source IP is allowed access to the endpoint
  - `mutual_tls` EndpointMutualTLSMutate
    - `enabled` boolean — `true` if the module will be applied to traffic, `false` to disable. default `true` if unspecified
    - `certificate_authority_ids` string[] — list of certificate authorities that will be used to validate the TLS client certificate presented by the initiator of the TLS connection
  - `tls_termination` EndpointTLSTermination
    - `enabled` boolean — `true` if the module will be applied to traffic, `false` to disable. default `true` if unspecified
    - `terminate_at` string — `edge` if the ngrok edge should terminate TLS traffic, `upstream` if TLS traffic should be passed through to the upstream ngrok agent / application server for termination. if `upstream` is chosen, most other modules will be disallowed because they rely on the ngrok edge being able to access the underlying traffic.
    - `min_version` string — The minimum TLS version used for termination and advertised to the client during the TLS handshake. if unspecified, ngrok will choose an industry-safe default. This value must be null if `terminate_at` is set to `upstream`.
  - `traffic_policy` EndpointTrafficPolicy
    - `enabled` boolean — `true` if the module will be applied to traffic, `false` to disable. default `true` if unspecified
    - `value` string — the traffic policy that should be applied to the traffic on your endpoint.

## Response `200`

Updates a TLS Edge by ID. If a module is not specified in the update, it will not be modified. However, each module configuration that is specified will completely replace the existing value. There is no way to delete an existing module via this API, instead use the delete module API.

- TLSEdge
  - `id` string — unique identifier of this edge
  - `description` string — human-readable description of what this edge will be used for; optional, max 255 bytes.
  - `metadata` string — arbitrary user-defined machine-readable data of this edge. Optional, max 4096 bytes.
  - `created_at` string — timestamp when the edge configuration was created, RFC 3339 format
  - `uri` string — URI of the edge API resource
  - `hostports` string[] — hostports served by this edge
  - `backend` EndpointBackend
    - `enabled` boolean — `true` if the module will be applied to traffic, `false` to disable. default `true` if unspecified
    - `backend` Ref
      - `id` string — a resource identifier
      - `uri` string — a uri for locating a resource
  - `ip_restriction` EndpointIPPolicy
    - `enabled` boolean — `true` if the module will be applied to traffic, `false` to disable. default `true` if unspecified
    - `ip_policies` Ref[] — list of all IP policies that will be used to check if a source IP is allowed access to the endpoint
      - `id` string — a resource identifier
      - `uri` string — a uri for locating a resource
  - `mutual_tls` EndpointMutualTLS
    - `enabled` boolean — `true` if the module will be applied to traffic, `false` to disable. default `true` if unspecified
    - `certificate_authorities` Ref[] — PEM-encoded CA certificates that will be used to validate. Multiple CAs may be provided by concatenating them together.
      - `id` string — a resource identifier
      - `uri` string — a uri for locating a resource
  - `tls_termination` EndpointTLSTermination
    - `enabled` boolean — `true` if the module will be applied to traffic, `false` to disable. default `true` if unspecified
    - `terminate_at` string — `edge` if the ngrok edge should terminate TLS traffic, `upstream` if TLS traffic should be passed through to the upstream ngrok agent / application server for termination. if `upstream` is chosen, most other modules will be disallowed because they rely on the ngrok edge being able to access the underlying traffic.
    - `min_version` string — The minimum TLS version used for termination and advertised to the client during the TLS handshake. if unspecified, ngrok will choose an industry-safe default. This value must be null if `terminate_at` is set to `upstream`.
  - `traffic_policy` EndpointTrafficPolicy
    - `enabled` boolean — `true` if the module will be applied to traffic, `false` to disable. default `true` if unspecified
    - `value` string — the traffic policy that should be applied to the traffic on your endpoint.

---

[API](https://skmtc.net/ngrok/apis/ngrok-openapi.md) · [All operations](https://skmtc.net/ngrok/apis/ngrok-openapi/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/ngrok/ngrok-openapi/versions/1994bbb04714/schema)