---
title: "PATCH /v1/origin/apps/{appId}"
method: PATCH
path: "/v1/origin/apps/{appId}"
tags: ["OriginService"]
---

# PATCH /v1/origin/apps/{appId}

`PATCH /v1/origin/apps/{appId}`

## Request

- Base URL: `https://api.cursor.com`
- URL: `https://api.cursor.com/v1/origin/apps/{appId}`
- Auth: HTTP bearer

Updates an app's settings. Omitted fields are left unchanged; at least
 one settable field must be provided.

 Clearing `webhook_url` (providing it as an empty string) disables
 outbound webhook delivery and cancels the app's pending deliveries;
 re-setting a URL later does not resurrect cancelled deliveries.

## Path parameters

- `appId` string, required

## Request body

- object
  - `displayName` string: New human-facing app name. Must not be empty when provided.
  - `webhookUrl` string: New outbound webhook delivery URL: an absolute https URL. Providing an empty string disables webhook delivery and cancels the app's pending deliveries.
  - `events` AppEventsReplace: Clean-replace wrapper for `UpdateAppRequest.events`.
    - `events` string[]: The app's complete new set of webhook event subscriptions.
  - `description` string: New app description. Absent leaves it unchanged; empty clears it.
  - `websiteUrl` string: New publisher website. Absent leaves it unchanged; empty clears it.
  - `installationRedirectUris` AppInstallationRedirectUrisReplace: Clean-replace wrapper for `UpdateAppRequest.installation_redirect_uris`.
    - `installationRedirectUris` string[]: The app's complete new OAuth install callback allowlist.
  - `defaultScopes` AppDefaultScopesReplace: Clean-replace wrapper for `UpdateAppRequest.default_scopes`.
    - `scopes` string[]: The app's complete new set of default install scopes.

## Response `200`

OK

- App: An Origin app.
  - `id` string: Globally unique app identifier.
  - `displayName` string
  - `webhookUrl` string
  - `events` string[]: Outbound webhook event subscriptions. The `installation.*` events are always delivered and never appear here.
  - `createdAt` string, date-time
  - `updatedAt` string, date-time
  - `installationRedirectUris` string[]: OAuth install callback allowlist: redirect URIs an app-initiated install may return to, matched exactly at authorize time.
  - `namespaceSlug` string: Slug of the namespace that owns (publishes) the app.
  - `description` string: Publisher-provided app description. Empty when unset.
  - `websiteUrl` string: Publisher website. Empty when unset.
  - `defaultScopes` string[]: Default scopes offered when the app is installed, as catalog scope strings.

## Other responses

- `400`: Bad Request
- `401`: Unauthorized
- `403`: Forbidden
- `404`: The addressed resource, or its repository, does not exist or is not visible to the caller. Not-found and no-access are deliberately indistinguishable; a 404 never confirms that the resource does not exist.
- `429`: Too Many Requests
- `default`: Default error response

---

[API](https://skmtc.dev/cursor/apis/cursor-origin-api.md) - [All operations](https://skmtc.dev/cursor/apis/cursor-origin-api/llms.txt) - [OpenAPI document](https://skmtc.dev/cursor/apis/cursor-origin-api/revisions/cbc1547d6ef7?raw)