Sign in

v8

OpenAPI 3.1.02026-08-033623795.0 MB
Apps

Update App Permissions

Replaces the set of permissions the app requests from users when they install it. Requires a user session: the developer:update_app_authorization scope cannot be delegated to API keys.

patch/apps/{id}/permissions

Request body

Response

requested permissions updated

app_store_descriptionstring nullable required

Detailed description shown on the app store's in-depth app page, or null when none has been set.

app_type'b2b_app' | 'b2c_app' | 'company_app' | 'component' required

The type of end-user the app is built for.

base_urlstring nullable required

Production base URL where the app is hosted, or null if none is configured.

dashboard_pathstring nullable required

URL path for the account dashboard view, or null when not configured.

descriptionstring nullable required

Short description shown in listings and search results, or null if none has been set.

discover_pathstring nullable required

URL path for the discover view, or null when not configured.

domain_idstring required

Subdomain identifier for the app's proxied URL, forming https://{domain_id}.apps.whop.com.

experience_pathstring nullable required

URL path for the member-facing hub view, or null when not configured.

hosted_urlstring nullable required

Full URL where the app's hosted web build is served, or null if no route is claimed.

idstring required

App ID, prefixed app_.

marketplace_status'not_available' | 'pending_review' | 'live_marketplace' | 'null' nullable required

Approval status of the app's product listing on the Whop app store, or null when the app has no associated product.

namestring required

Display name shown on the app store and in experience navigation.

oauth_client_type'public' | 'confidential' required

How the app authenticates at the OAuth token endpoint.

openapi_pathstring nullable required

URL path to the app's OpenAPI spec file, or null when not configured.

originstring nullable required

Full origin URL of the app's proxied domain, for example https://ab1c2d3e4f.apps.whop.com.

product_idstring nullable required

ID of the app's product listing on the Whop app store, or null when the app has no associated product.

redirect_urisstring[] required
required_scopesstring[] required
routestring nullable required

Claimed subdomain route where hosted web builds are served (myapp for myapp.whop.app), or null if no route is claimed.

secretsobject nullable required

The app's production secrets as an object of string values, injected into the hosted server runtime. null when the caller lacks the developer:update_app permission.

skills_pathstring nullable required

URL path to the app's skills directory, or null when not configured.

status'live' | 'unlisted' | 'hidden' required

Visibility on the Whop app store: live is publicly discoverable, unlisted is accessible only via direct link, hidden is not visible anywhere.

verifiedboolean required

Whether the app has been verified by Whop and is eligible for the featured apps section.

Example response

{
  "app_type": "b2b_app",
  "marketplace_status": "not_available",
  "oauth_client_type": "public",
  "production_android_build": {
    "status": "draft"
  },
  "production_ios_build": {
    "status": "draft"
  },
  "production_web_build": {
    "status": "draft"
  },
  "required_scopes": [
    "read_user"
  ],
  "status": "live"
}