--- title: "Update an existing priority" method: PATCH path: "/priorities/{id}" tags: ["Priorities"] --- # Update an existing priority `PATCH /priorities/{id}` ## Request - Base URL: `https://priorityprotect-api.datadome.co/v1` - URL: `https://priorityprotect-api.datadome.co/v1/priorities/{id}` - Auth: API key in header `x-api-key` Performs a **partial update** on the specified priority using **JSON Merge Patch** semantics (RFC 7396). Only fields provided in the payload are modified; omitted fields remain unchanged. Immutable fields like `id`, `testingToken`, `createdAt`, and `updatedAt` are ignored if included. `startAt` and `endAt` can be updated independently. For nested objects like `preAdmission`, the entire object is replaced, not merged. ## Path parameters - `id` string, uuid, required ## Request body - PriorityUpdate: Partial update of an existing priority. Only the fields provided in the request body are updated; all other fields remain unchanged. Uses **JSON Merge Patch** semantics (RFC 7396). Immutable fields (`id`, `testingToken`, `createdAt`, `updatedAt`) are ignored if present. `startAt` and `endAt` can be updated independently. For nested objects like `preAdmission`, the entire object is replaced, not merged. - `name` Name (unresolved $ref) - `maximumConcurrentVisitors` MaximumConcurrentVisitors (unresolved $ref) - `inactivityTimeoutMinutes` InactivityTimeoutMinutes (unresolved $ref) - `admissionRatePerMinute` AdmissionRatePerMinute (unresolved $ref) - `priority` Priority (unresolved $ref) - `matchingCondition` MatchingCondition (unresolved $ref) - `preAdmission` PreAdmission: Pre-admission configuration. If `durationMinutes` is greater than 0, the pre-admission is active and opens that many minutes before `startAt`. If `durationMinutes` is 0, no pre-admission is used. - `durationMinutes` integer: Number of minutes before `startAt` when the pre-admission opens. Set to 0 to disable the pre-admission. - `startAt` StartAt (unresolved $ref) - `endAt` EndAt (unresolved $ref) - `enforceClientSideValidation` EnforceClientSideValidation (unresolved $ref) - `allowAIAgent` AllowAIAgent (unresolved $ref) - `directAccessTrafficType` DirectAccessTrafficType (unresolved $ref) - `isEnabled` IsEnabled (unresolved $ref) - `templateId` string, uuid, nullable: Optional template ID (UUID) to associate a waiting room HTML template. Omit or set to `null` to use no template. ## Response `200` Successfully updated priority. - Priority - `id` string, uuid, required: System-generated unique identifier for the priority. - `name` string, required: Descriptive name of the priority, used for identification in the dashboard and API. Not shown to end users. - `maximumConcurrentVisitors` integer, required: Maximum number of concurrent visitors allowed on your website before new visitors are placed in the waiting room. - `inactivityTimeoutMinutes` integer, required: How long a visitor can be inactive before their session expires. Every interaction matching the waiting room scope will automatically reset this countdown. Must be between 5 and 30 minutes. - `admissionRatePerMinute` integer, required: Maximum number of visitors allowed to leave the waiting room and access the website each minute. This smooths traffic bursts and prevents thundering herd effects when the queue opens. - `priority` integer: Determines order of evaluation when multiple priorities could apply. Lower values take precedence. - `matchingCondition` string, required: Boolean expression defining which traffic is sent to this priority. Uses DataDome Lucene syntax with `AND`, `OR`, `NOT` operators and `field:value` matching. **Examples:** - `domain:www.example.com AND url:/product/*` - `domain:*` - `(countrycode:US OR countrycode:CA) AND url:/sale` - `domain:shop.example.com AND NOT method:GET` - `preAdmission` PreAdmission: Pre-admission configuration. If `durationMinutes` is greater than 0, the pre-admission is active and opens that many minutes before `startAt`. If `durationMinutes` is 0, no pre-admission is used. - `durationMinutes` integer: Number of minutes before `startAt` when the pre-admission opens. Set to 0 to disable the pre-admission. - `startAt` string, date-time, nullable: UTC timestamp when the priority becomes active (inclusive). ISO 8601 format. - `endAt` string, date-time, nullable: UTC timestamp when the priority expires and stops accepting visitors (exclusive). ISO 8601 format. - `enforceClientSideValidation` boolean: When `true`, visitors passing through the queue must successfully execute client-side validation logic in their browser before being granted access to the protected website. - `allowAIAgent` boolean: When `true`, known AI or automated agents are allowed to bypass the waiting room. - `directAccessTrafficType` string[], required: Traffic categories allowed to skip the waiting room entirely. Subset of `verifiedBots`, `customRules`. An empty array means no category bypasses. **POST:** optional; `[]`, `["verifiedBots"]`, `["customRules"]` or `["verifiedBots","customRules"]` are accepted. Omitted defaults to `[]`. Explicit `null` or unknown values return `400`. **PATCH:** omit the field to leave the current set untouched. Provide `[]` to clear it or a subset to replace it. `null` returns `400`. - `isEnabled` boolean, required: When `true`, the priority is active and is triggered if configuration conditions are met. When `false`, the priority is never triggered. - `template` TemplateEmbed: Embedded template summary returned inside a priority response. - `id` string, uuid: Unique identifier of the template. - `name` string: Name of the template. - `testingToken` string, uuid: Token that allows testing this priority for debugging or privileged access. Automatically generated at creation time and cannot be modified. **Security note:** This is a sensitive secret. Only returned when `includeTestingToken=true` is explicitly provided on GET requests. - `createdAt` string, date-time, required: Timestamp when the priority was created (ISO 8601 UTC). - `updatedAt` string, date-time, required: Timestamp when the priority configuration was last updated (ISO 8601 UTC). ## Other responses - `400`: Bad request - malformed JSON or invalid field types. - `401`: Unauthorized - missing or invalid API key. - `403`: Forbidden. The provided API key is valid, but the user does not have sufficient permissions to perform this operation. - `404`: Resource not found. - `422`: Unprocessable entity - validation failure. Examples: a required field missing (`name`, `admissionRatePerMinute`, `matchingCondition`), a field value outside its documented range (e.g. `inactivityTimeoutMinutes` outside 5-30), an invalid `directAccessTrafficType` value, `startAt >= endAt`, invalid matching condition syntax, duplicate priority value. --- [API](https://skmtc.dev/datadome/apis/priority-protect-management-api.md) - [All operations](https://skmtc.dev/datadome/apis/priority-protect-management-api/llms.txt) - [OpenAPI document](https://skmtc.dev/datadome/apis/priority-protect-management-api/revisions/0eb7133cb637?raw)