---
title: "Update"
method: POST
path: "/api/v1/apps/{app_id}/authzen_servers/{id}"
tags: ["AuthZEN Servers"]
---

# Update

`POST /api/v1/apps/{app_id}/authzen_servers/{id}`

## Request

- Base URL: `https://example.conductor.one`
- URL: `https://example.conductor.one/api/v1/apps/{app_id}/authzen_servers/{id}`
- Auth: HTTP bearer and OAuth 2
  - Client credentials
  - Token URL: `/auth/v1/token`

Update edits a server's mode via update_mask.

## Path parameters

- `app_id` string, required: App identifier.
- `id` string, required: The id field.

## Request body

- C1ApiAuthzenV1AuthzenServerServiceUpdateRequestInput: AuthzenServerServiceUpdateRequest updates mode or active_policy_id via an update mask.
  - `authzenServer` C1ApiAuthzenV1AuthzenServer: AuthzenServer is the customer-facing AuthZEN PDP endpoint for one App.
    - `activePolicyId` string: The active immutable policy revision. Empty is default deny.
    - `appId` string: App identifier.
    - `createdAt` string, date-time, nullable
    - `displayName` string: The displayName field.
    - `evaluateEntitlementId` string: The minted "evaluate" entitlement (derived from the server id; returned for linking) -- grant it to a caller to let it POST the access evaluation endpoint.
    - `id` string: The id field.
    - `mode` 'AUTHZEN_MODE_UNSPECIFIED' | 'AUTHZEN_MODE_DISABLED' | 'AUTHZEN_MODE_OBSERVE' | 'AUTHZEN_MODE_ENFORCE': The e-stop, now a tri-state. DISABLED (and UNSPECIFIED) denies every call without touching the entitlement stack or its grants; OBSERVE evaluates fully but answers allow, recording what ENFORCE would have said; ENFORCE answers the policy's decision.
    - `searchEntitlementId` string: The minted "search" entitlement (derived from the server id; returned for linking) -- grant it to a caller to let it POST the subject/resource/action search endpoints.
    - `tokenAudience` string: The `audience` to send when exchanging a token for access to this server. Every AuthZEN deployment in the tenant shares it, so it names the service; `token_resource` names this server.
    - `tokenResource` string: The `resource` to send alongside `token_audience`. It pins the exchange to this server, and the issued grant echoes it back, so send it exactly as given.
    - `tokenScopes` string[], nullable: The scopes this server can issue. An exchange receives the ones it requests that the caller also holds the matching capability entitlement for.
    - `updatedAt` string, date-time, nullable
  - `updateMask` string, nullable

## Response `200`

AuthzenServerServiceUpdateResponse returns the updated server.

- C1ApiAuthzenV1AuthzenServerServiceUpdateResponse: AuthzenServerServiceUpdateResponse returns the updated server.
  - `authzenServer` C1ApiAuthzenV1AuthzenServer: AuthzenServer is the customer-facing AuthZEN PDP endpoint for one App.
    - `activePolicyId` string: The active immutable policy revision. Empty is default deny.
    - `appId` string: App identifier.
    - `createdAt` string, date-time, nullable
    - `displayName` string: The displayName field.
    - `evaluateEntitlementId` string: The minted "evaluate" entitlement (derived from the server id; returned for linking) -- grant it to a caller to let it POST the access evaluation endpoint.
    - `id` string: The id field.
    - `mode` 'AUTHZEN_MODE_UNSPECIFIED' | 'AUTHZEN_MODE_DISABLED' | 'AUTHZEN_MODE_OBSERVE' | 'AUTHZEN_MODE_ENFORCE': The e-stop, now a tri-state. DISABLED (and UNSPECIFIED) denies every call without touching the entitlement stack or its grants; OBSERVE evaluates fully but answers allow, recording what ENFORCE would have said; ENFORCE answers the policy's decision.
    - `searchEntitlementId` string: The minted "search" entitlement (derived from the server id; returned for linking) -- grant it to a caller to let it POST the subject/resource/action search endpoints.
    - `tokenAudience` string: The `audience` to send when exchanging a token for access to this server. Every AuthZEN deployment in the tenant shares it, so it names the service; `token_resource` names this server.
    - `tokenResource` string: The `resource` to send alongside `token_audience`. It pins the exchange to this server, and the issued grant echoes it back, so send it exactly as given.
    - `tokenScopes` string[], nullable: The scopes this server can issue. An exchange receives the ones it requests that the caller also holds the matching capability entitlement for.
    - `updatedAt` string, date-time, nullable

## Changes

- **2026-10-06** `918a4e749f56`: 1 info
  - endpoint added

[Operation history](https://skmtc.dev/conductorone/apis/c1-api/changes/api/v1/apps/:app_id/authzen_servers/:id/post.md)

---

[API](https://skmtc.dev/conductorone/apis/c1-api.md) - [All operations](https://skmtc.dev/conductorone/apis/c1-api/llms.txt) - [OpenAPI document](https://skmtc.dev/conductorone/apis/c1-api/revisions/fe943bedf41b?raw)