---
title: "Update App Permissions"
method: PATCH
path: "/apps/{id}/permissions"
tags: ["Apps"]
---

# Update App Permissions

`PATCH /apps/{id}/permissions`

Replaces the set of permissions the app requests from users when they install it. Requires a user session: the `developer:update_app_authorization` scope cannot be delegated to API keys.

## Request body

- object
  - `requested_permissions` object[], required — The full set of permissions the app requests on install; permissions not listed are removed.
    - `action` string, required — The permission action, for example `company:basic:read`.
    - `is_required` boolean, required — Whether installing the app requires granting this permission.
    - `justification` string, required — Why the app needs this permission (20-512 characters), shown to the installing user.

## Response `200`

requested permissions updated

- App
  - `account` AccountSummary, required
    - `id` string, required — Account ID, prefixed `biz_`.
    - `title` string, required — Account display name.
  - `api_key` AppApiKey, required
    - `created_at` string, required — When the key was created, as an ISO 8601 timestamp.
    - `token` string, required — The key's secret token, sent as a bearer token to authenticate requests on the app's behalf.
  - `app_store_description` string, nullable, required — Detailed description shown on the app store's in-depth app page, or `null` when none has been set.
  - `app_type` 'b2b_app' | 'b2c_app' | 'company_app' | 'component' | 'website', required — The type of end-user the app is built for.
  - `base_url` string, nullable, required — Production base URL where the app is hosted, or `null` if none is configured.
  - `creator` AppCreator, required
    - `id` string, required — User ID, prefixed `user_`.
    - `name` string, nullable, required — Display name.
    - `username` string, required — Public username.
  - `dashboard_path` string, nullable, required — URL path for the account dashboard view, or `null` when not configured.
  - `default_api_key` AppDefaultApiKey, required
    - `id` string, required — API key ID, prefixed `apik_`.
    - `name` string, nullable, required — Human-readable name identifying the API key, or `null` when none was set.
    - `obfuscated_secret_key` string, required — Masked version of the secret key, so the key can be recognized without revealing the full secret.
    - `secret_key` string, nullable, required — The full secret used to authenticate requests. `null` unless the caller could have created the key themselves.
  - `description` string, nullable, required — Short description shown in listings and search results, or `null` if none has been set.
  - `discover_path` string, nullable, required — URL path for the discover view, or `null` when not configured.
  - `domain_id` string, required — Subdomain identifier for the app's proxied URL, forming https://{domain_id}.apps.whop.com.
  - `experience_path` string, nullable, required — URL path for the member-facing hub view, or `null` when not configured.
  - `hosted_url` string, nullable, required — Full URL where the app's hosted web build is served, or `null` if no route is claimed.
  - `icon` AppIcon, required
    - `url` string, required — Icon image URL. Always present — the default app icon when none is uploaded.
  - `id` string, required — App ID, prefixed `app_`.
  - `marketplace_status` 'not_available' | 'pending_review' | 'live_marketplace' | 'null', nullable, required — Approval status of the app's product listing on the Whop app store, or `null` when the app has no associated product.
  - `name` string, required — Display name shown on the app store and in experience navigation.
  - `oauth_client_type` 'public' | 'confidential', required — How the app authenticates at the OAuth token endpoint.
  - `openapi_path` string, nullable, required — URL path to the app's OpenAPI spec file, or `null` when not configured.
  - `origin` string, nullable, required — Full origin URL of the app's proxied domain, for example https://ab1c2d3e4f.apps.whop.com.
  - `product_id` string, nullable, required — ID of the app's product listing on the Whop app store, or `null` when the app has no associated product.
  - `production_android_build` AppProductionBuild, required
    - `checksum` string, nullable, required — Client-generated checksum of the build file, used to verify file integrity.
    - `file_url` string, nullable, required — URL to download the uploaded build artifact.
    - `id` string, required — App build ID, prefixed `abld_`.
    - `source_url` string, nullable, required — URL to download the compressed source code archive that produced this build, or `null` when the build was uploaded without a source archive.
    - `status` 'draft' | 'pending' | 'approved' | 'rejected', required — The build's review status.
  - `production_ios_build` AppProductionBuild, required
    - `checksum` string, nullable, required — Client-generated checksum of the build file, used to verify file integrity.
    - `file_url` string, nullable, required — URL to download the uploaded build artifact.
    - `id` string, required — App build ID, prefixed `abld_`.
    - `source_url` string, nullable, required — URL to download the compressed source code archive that produced this build, or `null` when the build was uploaded without a source archive.
    - `status` 'draft' | 'pending' | 'approved' | 'rejected', required — The build's review status.
  - `production_web_build` AppProductionBuild, required
    - `checksum` string, nullable, required — Client-generated checksum of the build file, used to verify file integrity.
    - `file_url` string, nullable, required — URL to download the uploaded build artifact.
    - `id` string, required — App build ID, prefixed `abld_`.
    - `source_url` string, nullable, required — URL to download the compressed source code archive that produced this build, or `null` when the build was uploaded without a source archive.
    - `status` 'draft' | 'pending' | 'approved' | 'rejected', required — The build's review status.
  - `redirect_uris` string[], required
  - `requested_permissions` AppRequestedPermission[], required
    - `is_required` boolean, required — Whether the app requires the permission to be granted on install, as opposed to requesting it optionally.
    - `justification` string, nullable, required — The developer's explanation of why the app needs the permission, or `null` when none was provided.
    - `permission_action` AppRequestedPermissionAction, required
      - `action` string, required — The permission action's identifier, for example `company:basic:read`.
      - `name` string, required — Human-readable name of the action.
  - `required_scopes` string[], required
  - `route` string, nullable, required — Claimed subdomain route where hosted web builds are served (`myapp` for myapp.whop.app), or `null` if no route is claimed.
  - `secrets` object, nullable, required — The app's production secrets as an object of string values, injected into the hosted server runtime. `null` when the caller lacks the `developer:update_app` permission.
  - `skills_path` string, nullable, required — URL path to the app's skills directory, or `null` when not configured.
  - `status` 'live' | 'unlisted' | 'hidden', required — Visibility on the Whop app store: `live` is publicly discoverable, `unlisted` is accessible only via direct link, `hidden` is not visible anywhere.
  - `verified` boolean, required — Whether the app has been verified by Whop and is eligible for the featured apps section.

## Other responses

- `400` — Invalid Parameters
- `401` — Unauthorized
- `403` — Forbidden
- `404` — Resource not found

---

[API](https://skmtc.net/whop/apis/whop-api.md) · [All operations](https://skmtc.net/whop/apis/whop-api/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/whop/whop-api/versions/866821546d67/schema)