`PATCH /apps/{id}` — update mutable fields. Role writes are gated by [`validate_app_role`] (no admin/owner). Status flip to `"inactive"` here doesn't cascade-revoke keys; that's `DELETE`'s job and the admin-UI distinction.

PATCH/apps/{id}

Request Body

application/json

TypeScript Definitions

Use the request body type in TypeScript.

PATCH /apps/{id} body. Every field optional — absent means unchanged. role cannot be moved to admin/owner (rejected at the handler).

description?string|null

name?string|null

owner_user_id?|

Handoff lever — reassign the app from Alice to Bob before Alice gets deprovisioned. Must name an active, non-app user in the caller's org; the handler rejects anything else with 400.

Not "an admin", which an earlier wording said: the holder of apps:write is routinely a non-admin now, so a rule naming admins would contradict the gate in the same file. Active, because the field's one consumer is the deprovisioning handoff gate — handing off to a deprovisioned user recreates what that gate exists to prevent. Non-app, because an App owning an App is a cycle the same gate would chase.

published?|

ADR-0050 §6 catalog flag. Defaults to false. Inert — nothing reads it for any decision today.

required_permissions?array<string>|

The resource:action manifest this app declares it needs (ADR-0050 §1). Absent and [] are both legal and both mean "declares nothing"; declaring confers nothing — the bound is the installer's authority at install time. Validated on write: every token must parse and must not name an owner-only lever.

role?null|

status?null|

team_ids?array<string>|null

Response Body

`application/json`

curl -X PATCH "https://example.com/apps/string" \  -H "Content-Type: application/json" \  -d '{}'

{  "created_at": "string",  "description": "string",  "email": "string",  "id": "string",  "name": "string",  "owner_user_id": "string",  "published": true,  "required_permissions": [    "string"  ],  "role": null,  "status": null,  "team_ids": [    "string"  ],  "updated_at": "string"}

`PATCH /apps/{id}` — update mutable fields. Role writes are gated by [`validate_app_role`] (no admin/owner). Status flip to `"inactive"` here doesn't cascade-revoke keys; that's `DELETE`'s job and the admin-UI distinction.

Path Parameters

Request Body

Response Body

200application/json

400

403

404

`application/json`