--- title: "UpdateInstallation" method: PATCH path: "/v1/namespaces/{object.tenant_meta.namespace}/installations" tags: ["InstallationService"] --- # UpdateInstallation `PATCH /v1/namespaces/{object.tenant_meta.namespace}/installations` Updates an installation. ## Path parameters - `object.tenant_meta.namespace` string, required ## Request body - InstallationServiceUpdateInstallationBody — Request to update an installation. - `object` object — Installation represents an installation request in the system. - `meta` V1Meta — Common fields for all Endor Labs resources. - `annotations` object — Annotations can be used to attach metadata to a resource message. Annotation values can be small or large, structured or unstructured, and may include characters not permitted by labels. The keys may contain alphanumerics, underscores (_), dots (.) and dashes (-). The values of an annotation must be 16384 bytes or smaller. - `create_time` string, date-time — Time the resource was created. Format: 2017-01-15T01:30:15.01Z RFC 3339: https://www.ietf.org/rfc/rfc3339.txt. - `created_by` string — Name and authentication source of the user who created the object, for example, ewok@endor.ai@google@api-key. - `description` string — Resource description. Must be less than 1024 bytes. - `index_data` V1IndexData — IndexData is used to index the resource for search. It's an internal object. - `data` string[] - `search_score` number, float — search_score is the score of the resource for search. Internal use only. - `tenant` string - `will_be_deleted_at` string, date-time — Time that the resource will be deleted. - `kind` string — Resource kind, for example, HelloResponse. Auto-generated using the protobuf message proto.MessageName().Name(). - `name` string, required — Resource name. Must be 63 characters or less. - `parent_kind` string — Parent object resource kind, for example, Project. - `parent_uuid` string — Parent object UUID. - `references` object — Map of objects referenced in a query API. - `tags` string[] — List of tags attached to the resource. Tags can be used to select objects and to find collections of objects that satisfy certain conditions. A tag must be 255 characters or less. - `update_time` string, date-time — Time the resource was last updated. Note: Updated on all create/patch/delete operations. Format: 2017-01-15T01:30:15.01Z RFC 3339: https://www.ietf.org/rfc/rfc3339.txt. - `updated_by` string — Name and authentication source of the last user who updated the object, for example, vulnerabilityingestor@endor.ai@x509. - `upsert_time` string, date-time — Time the resource was last upserted. Note: create_time is only set the first time the resource is created. upsert_time is set every time the resource is upseted. Format: 2017-01-15T01:30:15.01Z RFC 3339: https://www.ietf.org/rfc/rfc3339.txt. - `version` string — Message version. - `processing_status` V1ProcessingStatus - `analytic_time` string, date-time — Last time a project was analyzed. Format: 2017-01-15T01:30:15.01Z RFC 3339: https://www.ietf.org/rfc/rfc3339.txt. - `deactivated` boolean — Indicates whether the project is deactivated. Deactivated projects are not scanned and are not visible to users in the UI by default. - `disable_automated_scan` boolean — This is a private package and it must not be scanned by the background scheduler. It will be scanned by an endorctl client instead. Default: false. - `metadata` V1ProcessingStatusMetadata - `full_history_scan_time` string, date-time - `queue_time` string, date-time — Last time a project was queued. Format: 2017-01-15T01:30:15.01Z RFC 3339: https://www.ietf.org/rfc/rfc3339.txt. - `scan_state` 'SCAN_STATE_UNSPECIFIED' | 'SCAN_STATE_NOT_PROCESSED' | 'SCAN_STATE_IDLE' | 'SCAN_STATE_INGESTING' | 'SCAN_STATE_ANALYTIC' | 'SCAN_STATE_UNREACHABLE' | 'SCAN_STATE_REQUEST_FULL_RESCAN' | 'SCAN_STATE_REQUEST_INCREMENTAL_RESCAN' | 'SCAN_STATE_QUEUED' | 'SCAN_STATE_QUARANTINED' — Scan state for a project or package version. - SCAN_STATE_NOT_PROCESSED: Object has not been processed by the system yet. Set when the project or package is created for the first time. A new project or package version is automatically placed in this state. - SCAN_STATE_IDLE: Object has been scanned at least once. - SCAN_STATE_INGESTING: Object is being scanned. - SCAN_STATE_ANALYTIC: Object is being analyzed. - SCAN_STATE_UNREACHABLE: Object cannot be ingested because it is not reachable from the scheduler. - SCAN_STATE_REQUEST_FULL_RESCAN: Object is marked for a complete rescan. This only applies to OSS projects. - SCAN_STATE_REQUEST_INCREMENTAL_RESCAN: Object is marked for an incremental rescan, where only new packages discovered in the scan are added. Indicates that this project should be rescanned with a higher priority. Often because it is used by a customer and we need any new packages to be discovered and scanned with higher priority. If the project is put in this state, we will scan any new packages at high priority but we will not re-scan older packages. - SCAN_STATE_QUEUED: Object is queued to be scanned. - SCAN_STATE_QUARANTINED: Scan scheduling was unsuccessful due to a system errors. Object is quarantined from additional scheduling. Potentially object is an orphan or similar situations. - `scan_time` string, date-time — Last time a project was ingested. Format: 2017-01-15T01:30:15.01Z RFC 3339: https://www.ietf.org/rfc/rfc3339.txt - `propagate` boolean — Propagate indicates that the object should be visible in child namespaces. - `spec` V1InstallationSpec - `azure_config` V1AzureConfig - `enable_full_scan` boolean — enable_full_scan is a boolean value that indicates if the full scan should be enabled for Azure DevOps PR scans. - `enable_pr_comments` boolean — enable_pr_comments is a boolean value that indicates if automated PR comments are enabled for Azure DevOps repositories. - `enable_pr_scans` boolean — enable_pr_scans is a boolean value that indicates if automated PR scans are enabled for Azure DevOps repositories. - `host_url` string, required — The URL of the project. - `personal_access_token` string — PAT of the user doing integration to fetch resources using REST APIs. - `webhook_secret` string — The shared password configured as the basic authentication credential for Azure DevOps Service Hook deliveries belonging to this installation. - `bitbucket_config` V1BitBucketConfig - `cloud` V1BitBucketCloudAuthConfig — Configuration for Bitbucket Cloud authentication. - `access_token` string, required - `app_password_config` V1AppPasswordConfig — AppPasswordConfig holds HTTP Basic Auth credentials for Bitbucket Cloud. It supports both legacy App Passwords and its replacement, Atlassian Scoped API Tokens (https://support.atlassian.com/bitbucket-cloud/docs/api-tokens/). Both use the same HTTP Basic Auth mechanism (username:token). NOTE: Bitbucket App Passwords are deprecated and will be removed on June 9, 2026. New integrations should use Scoped API Tokens. - `app_password` string, required — The App Password or Atlassian Scoped API Token used for HTTP Basic Auth. Both credential types are wire-compatible (username:token in Basic Auth header). - `username` string, required — The username (or Atlassian account email for Scoped API Tokens) used for HTTP Basic Auth against Bitbucket Cloud. - `data_center` V1BitBucketDataCenterAuthConfig — Configuration for Bitbucket Datacenter authentication. - `http_access_token` string, required — The HTTP Access Token used for Bitbucket Datacenter authentication. - `enable_full_scan` boolean — enable_full_scan is a boolean value that indicates if the full scan should be enabled. - `enable_pr_comments` boolean — enable_pr_comments is a boolean value that indicates if the automated PR comments should be enabled. - `enable_pr_scans` boolean — enable_pr_scans is a boolean value that indicates if the automated PR scans are enabled. - `host_url` string, required — The URL of the workspace (only for cloud) or project. - `webhook_secret` string — The webhook secret configured in Bitbucket for validating incoming webhook events. - `cleanup_stale_namespaces` boolean — Indicates whether stale managed namespaces that no longer correspond to groups or projects in the SCM should be automatically deleted during installation reconciliation. Default value is false. - `enabled_features` SpecEnabledFeatureType[] - `exclude_project_regexes` string[] — exclude_project_regexes is a list of RE2 regular expression patterns used to exclude repositories from ingestion during SCM integration reconciliation. A repository is excluded if its name (leaf name only, not the full URL or path) matches any pattern in this list. Matching is case-sensitive. An empty list means no filtering is applied. Supports a maximum of 20 patterns. - `external_id` string — The external ID of the installation. - `external_name` string — The external name of the installation. - `github_config` V1GitHubConfig - `app_id` string — The app id of the installation. - `enable_full_scan` boolean — enable_full_scan is a boolean value that indicates if the full scan should be enabled. - `enable_pr_comments` boolean — enable_pr_comments is a boolean value that indicates if the automated PR comments should be enabled. - `enable_pr_scans` boolean — enable_pr_scans is a boolean value that indicates if the automated PR scans are enabled. - `host_url` string — The base URL of the corresponding SCM app. - `include_archived_repos` boolean — include_archived_repos is a boolean value that indicates if the archived repos should be included. Default will be off. - `installation_github_user` string - `gitlab_config` V1GitLabConfig - `enable_full_scan` boolean — enable_full_scan is a boolean value that indicates if the full scan should be enabled. - `enable_mr_comments` boolean — enable_mr_comments is a boolean value that indicates if the automated MR comments should be enabled. - `enable_mr_scans` boolean — enable_mr_scans is a boolean value that indicates if the automated MR scans are enabled. - `host_url` string, required — The URL of the group/sub-group. - `personal_access_token` string — PAT of the user doing integration to fetch resources using REST APIs. - `webhook_secret` string — The webhook secret configured in GitLab for validating incoming webhook events. - `huggingface_config` V1HuggingFaceConfig - `access_token` string — Optional HuggingFace API token used to authenticate requests for private models within the organization. When omitted, only publicly accessible models are discovered. - `avatar_url` string — Avatar URL of the HuggingFace organization. - `host_url` string, required - `include_archived_repos` boolean — include_archived_repos is a boolean value that indicates if the archived repos should be included. Default will be off. - `ingestion_time` string, date-time — The last time that we ingested the installation data. - `ingestion_token` string — The API token that the scanner can use for scanning installation related information. If it is empty, the scanner will use local authentication information. - `installation_error_message` string — Message explaining why the installation is invalid. This field is populated when invalid is true. - `invalid` boolean — Identifies the installations that are in the system, but potentially their corresponding configuration has been removed from GitHub and thus we cannot authenticate. In this case, we stop trying to re-sync with this installation. - `login` string — The login of the account taken directly from the GitHub response VS spec.user, which is inferred from the identity token in the request context. - `marked_for_deletion` boolean — Indicates the installation is marked for deletion, and in next sync call the installation with its related data will be deleted. - `platform_source` 'PLATFORM_SOURCE_TYPE_UNSPECIFIED' | 'PLATFORM_SOURCE_TYPE_AZURE' | 'PLATFORM_SOURCE_TYPE_BITBUCKET' | 'PLATFORM_SOURCE_TYPE_GITHUB' | 'PLATFORM_SOURCE_TYPE_GITLAB' — Deprecated: Use platform_type instead. - `platform_type` 'PLATFORM_SOURCE_UNSPECIFIED' | 'PLATFORM_SOURCE_GITHUB' | 'PLATFORM_SOURCE_GITLAB' | 'PLATFORM_SOURCE_GITSERVER' | 'PLATFORM_SOURCE_BITBUCKET' | 'PLATFORM_SOURCE_BINARY' | 'PLATFORM_SOURCE_HUGGING_FACE' | 'PLATFORM_SOURCE_AZURE' | 'PLATFORM_SOURCE_ARCHIVE' | 'PLATFORM_SOURCE_EXTERNAL_AI_SERVICE' | 'PLATFORM_SOURCE_GITHUB_ENTERPRISE' — Type of source control platform a resource was discovered on. - `project_uuids` string[] — The list of projects that are associated with this installation. - `public` boolean — Apply only to public repositories. Default value is false. - `scm_app_uuid` string — The UUID of the SCM app being installed. - `suspended` boolean — Indicates if the installation is suspended. - `target_type` string — The target of the installation (Organization or User). - `user` string — The user name of the user that initiated the installation. Refers back to the GitHub user name. - `tenant_meta` object — Namespaces are associated with a tenant. - `uuid` string — The UUID of the installation. - `request` V1UpdateRequest — Message used for all update requests. - `force` boolean — Force will force the update of the resource if any checks fail. - `update_mask` string — Fields to update. Defaults to all fields. ## Response `200` A successful response. - V1Installation — Installation represents an installation request in the system. - `meta` V1Meta, required — Common fields for all Endor Labs resources. - `annotations` object — Annotations can be used to attach metadata to a resource message. Annotation values can be small or large, structured or unstructured, and may include characters not permitted by labels. The keys may contain alphanumerics, underscores (_), dots (.) and dashes (-). The values of an annotation must be 16384 bytes or smaller. - `create_time` string, date-time — Time the resource was created. Format: 2017-01-15T01:30:15.01Z RFC 3339: https://www.ietf.org/rfc/rfc3339.txt. - `created_by` string — Name and authentication source of the user who created the object, for example, ewok@endor.ai@google@api-key. - `description` string — Resource description. Must be less than 1024 bytes. - `index_data` V1IndexData — IndexData is used to index the resource for search. It's an internal object. - `data` string[] - `search_score` number, float — search_score is the score of the resource for search. Internal use only. - `tenant` string - `will_be_deleted_at` string, date-time — Time that the resource will be deleted. - `kind` string — Resource kind, for example, HelloResponse. Auto-generated using the protobuf message proto.MessageName().Name(). - `name` string, required — Resource name. Must be 63 characters or less. - `parent_kind` string — Parent object resource kind, for example, Project. - `parent_uuid` string — Parent object UUID. - `references` object — Map of objects referenced in a query API. - `tags` string[] — List of tags attached to the resource. Tags can be used to select objects and to find collections of objects that satisfy certain conditions. A tag must be 255 characters or less. - `update_time` string, date-time — Time the resource was last updated. Note: Updated on all create/patch/delete operations. Format: 2017-01-15T01:30:15.01Z RFC 3339: https://www.ietf.org/rfc/rfc3339.txt. - `updated_by` string — Name and authentication source of the last user who updated the object, for example, vulnerabilityingestor@endor.ai@x509. - `upsert_time` string, date-time — Time the resource was last upserted. Note: create_time is only set the first time the resource is created. upsert_time is set every time the resource is upseted. Format: 2017-01-15T01:30:15.01Z RFC 3339: https://www.ietf.org/rfc/rfc3339.txt. - `version` string — Message version. - `processing_status` V1ProcessingStatus - `analytic_time` string, date-time — Last time a project was analyzed. Format: 2017-01-15T01:30:15.01Z RFC 3339: https://www.ietf.org/rfc/rfc3339.txt. - `deactivated` boolean — Indicates whether the project is deactivated. Deactivated projects are not scanned and are not visible to users in the UI by default. - `disable_automated_scan` boolean — This is a private package and it must not be scanned by the background scheduler. It will be scanned by an endorctl client instead. Default: false. - `metadata` V1ProcessingStatusMetadata - `full_history_scan_time` string, date-time - `queue_time` string, date-time — Last time a project was queued. Format: 2017-01-15T01:30:15.01Z RFC 3339: https://www.ietf.org/rfc/rfc3339.txt. - `scan_state` 'SCAN_STATE_UNSPECIFIED' | 'SCAN_STATE_NOT_PROCESSED' | 'SCAN_STATE_IDLE' | 'SCAN_STATE_INGESTING' | 'SCAN_STATE_ANALYTIC' | 'SCAN_STATE_UNREACHABLE' | 'SCAN_STATE_REQUEST_FULL_RESCAN' | 'SCAN_STATE_REQUEST_INCREMENTAL_RESCAN' | 'SCAN_STATE_QUEUED' | 'SCAN_STATE_QUARANTINED' — Scan state for a project or package version. - SCAN_STATE_NOT_PROCESSED: Object has not been processed by the system yet. Set when the project or package is created for the first time. A new project or package version is automatically placed in this state. - SCAN_STATE_IDLE: Object has been scanned at least once. - SCAN_STATE_INGESTING: Object is being scanned. - SCAN_STATE_ANALYTIC: Object is being analyzed. - SCAN_STATE_UNREACHABLE: Object cannot be ingested because it is not reachable from the scheduler. - SCAN_STATE_REQUEST_FULL_RESCAN: Object is marked for a complete rescan. This only applies to OSS projects. - SCAN_STATE_REQUEST_INCREMENTAL_RESCAN: Object is marked for an incremental rescan, where only new packages discovered in the scan are added. Indicates that this project should be rescanned with a higher priority. Often because it is used by a customer and we need any new packages to be discovered and scanned with higher priority. If the project is put in this state, we will scan any new packages at high priority but we will not re-scan older packages. - SCAN_STATE_QUEUED: Object is queued to be scanned. - SCAN_STATE_QUARANTINED: Scan scheduling was unsuccessful due to a system errors. Object is quarantined from additional scheduling. Potentially object is an orphan or similar situations. - `scan_time` string, date-time — Last time a project was ingested. Format: 2017-01-15T01:30:15.01Z RFC 3339: https://www.ietf.org/rfc/rfc3339.txt - `propagate` boolean — Propagate indicates that the object should be visible in child namespaces. - `spec` V1InstallationSpec - `azure_config` V1AzureConfig - `enable_full_scan` boolean — enable_full_scan is a boolean value that indicates if the full scan should be enabled for Azure DevOps PR scans. - `enable_pr_comments` boolean — enable_pr_comments is a boolean value that indicates if automated PR comments are enabled for Azure DevOps repositories. - `enable_pr_scans` boolean — enable_pr_scans is a boolean value that indicates if automated PR scans are enabled for Azure DevOps repositories. - `host_url` string, required — The URL of the project. - `personal_access_token` string — PAT of the user doing integration to fetch resources using REST APIs. - `webhook_secret` string — The shared password configured as the basic authentication credential for Azure DevOps Service Hook deliveries belonging to this installation. - `bitbucket_config` V1BitBucketConfig - `cloud` V1BitBucketCloudAuthConfig — Configuration for Bitbucket Cloud authentication. - `access_token` string, required - `app_password_config` V1AppPasswordConfig — AppPasswordConfig holds HTTP Basic Auth credentials for Bitbucket Cloud. It supports both legacy App Passwords and its replacement, Atlassian Scoped API Tokens (https://support.atlassian.com/bitbucket-cloud/docs/api-tokens/). Both use the same HTTP Basic Auth mechanism (username:token). NOTE: Bitbucket App Passwords are deprecated and will be removed on June 9, 2026. New integrations should use Scoped API Tokens. - `app_password` string, required — The App Password or Atlassian Scoped API Token used for HTTP Basic Auth. Both credential types are wire-compatible (username:token in Basic Auth header). - `username` string, required — The username (or Atlassian account email for Scoped API Tokens) used for HTTP Basic Auth against Bitbucket Cloud. - `data_center` V1BitBucketDataCenterAuthConfig — Configuration for Bitbucket Datacenter authentication. - `http_access_token` string, required — The HTTP Access Token used for Bitbucket Datacenter authentication. - `enable_full_scan` boolean — enable_full_scan is a boolean value that indicates if the full scan should be enabled. - `enable_pr_comments` boolean — enable_pr_comments is a boolean value that indicates if the automated PR comments should be enabled. - `enable_pr_scans` boolean — enable_pr_scans is a boolean value that indicates if the automated PR scans are enabled. - `host_url` string, required — The URL of the workspace (only for cloud) or project. - `webhook_secret` string — The webhook secret configured in Bitbucket for validating incoming webhook events. - `cleanup_stale_namespaces` boolean — Indicates whether stale managed namespaces that no longer correspond to groups or projects in the SCM should be automatically deleted during installation reconciliation. Default value is false. - `enabled_features` SpecEnabledFeatureType[] - `exclude_project_regexes` string[] — exclude_project_regexes is a list of RE2 regular expression patterns used to exclude repositories from ingestion during SCM integration reconciliation. A repository is excluded if its name (leaf name only, not the full URL or path) matches any pattern in this list. Matching is case-sensitive. An empty list means no filtering is applied. Supports a maximum of 20 patterns. - `external_id` string — The external ID of the installation. - `external_name` string — The external name of the installation. - `github_config` V1GitHubConfig - `app_id` string — The app id of the installation. - `enable_full_scan` boolean — enable_full_scan is a boolean value that indicates if the full scan should be enabled. - `enable_pr_comments` boolean — enable_pr_comments is a boolean value that indicates if the automated PR comments should be enabled. - `enable_pr_scans` boolean — enable_pr_scans is a boolean value that indicates if the automated PR scans are enabled. - `host_url` string — The base URL of the corresponding SCM app. - `include_archived_repos` boolean — include_archived_repos is a boolean value that indicates if the archived repos should be included. Default will be off. - `installation_github_user` string - `gitlab_config` V1GitLabConfig - `enable_full_scan` boolean — enable_full_scan is a boolean value that indicates if the full scan should be enabled. - `enable_mr_comments` boolean — enable_mr_comments is a boolean value that indicates if the automated MR comments should be enabled. - `enable_mr_scans` boolean — enable_mr_scans is a boolean value that indicates if the automated MR scans are enabled. - `host_url` string, required — The URL of the group/sub-group. - `personal_access_token` string — PAT of the user doing integration to fetch resources using REST APIs. - `webhook_secret` string — The webhook secret configured in GitLab for validating incoming webhook events. - `huggingface_config` V1HuggingFaceConfig - `access_token` string — Optional HuggingFace API token used to authenticate requests for private models within the organization. When omitted, only publicly accessible models are discovered. - `avatar_url` string — Avatar URL of the HuggingFace organization. - `host_url` string, required - `include_archived_repos` boolean — include_archived_repos is a boolean value that indicates if the archived repos should be included. Default will be off. - `ingestion_time` string, date-time — The last time that we ingested the installation data. - `ingestion_token` string — The API token that the scanner can use for scanning installation related information. If it is empty, the scanner will use local authentication information. - `installation_error_message` string — Message explaining why the installation is invalid. This field is populated when invalid is true. - `invalid` boolean — Identifies the installations that are in the system, but potentially their corresponding configuration has been removed from GitHub and thus we cannot authenticate. In this case, we stop trying to re-sync with this installation. - `login` string — The login of the account taken directly from the GitHub response VS spec.user, which is inferred from the identity token in the request context. - `marked_for_deletion` boolean — Indicates the installation is marked for deletion, and in next sync call the installation with its related data will be deleted. - `platform_source` 'PLATFORM_SOURCE_TYPE_UNSPECIFIED' | 'PLATFORM_SOURCE_TYPE_AZURE' | 'PLATFORM_SOURCE_TYPE_BITBUCKET' | 'PLATFORM_SOURCE_TYPE_GITHUB' | 'PLATFORM_SOURCE_TYPE_GITLAB' — Deprecated: Use platform_type instead. - `platform_type` 'PLATFORM_SOURCE_UNSPECIFIED' | 'PLATFORM_SOURCE_GITHUB' | 'PLATFORM_SOURCE_GITLAB' | 'PLATFORM_SOURCE_GITSERVER' | 'PLATFORM_SOURCE_BITBUCKET' | 'PLATFORM_SOURCE_BINARY' | 'PLATFORM_SOURCE_HUGGING_FACE' | 'PLATFORM_SOURCE_AZURE' | 'PLATFORM_SOURCE_ARCHIVE' | 'PLATFORM_SOURCE_EXTERNAL_AI_SERVICE' | 'PLATFORM_SOURCE_GITHUB_ENTERPRISE' — Type of source control platform a resource was discovered on. - `project_uuids` string[] — The list of projects that are associated with this installation. - `public` boolean — Apply only to public repositories. Default value is false. - `scm_app_uuid` string — The UUID of the SCM app being installed. - `suspended` boolean — Indicates if the installation is suspended. - `target_type` string — The target of the installation (Organization or User). - `user` string — The user name of the user that initiated the installation. Refers back to the GitHub user name. - `tenant_meta` V1TenantMeta, required — Tenant related data for the tenant containing the resource. - `namespace` string, required — Namespaces are a way to organize organizational units into virtual groupings of resources. Namespaces must be a fully qualified name, for example, the child namespace of namespace "endor.prod" called "app" is called "endor.prod.app". - `uuid` string — The UUID of the installation. ## Other responses - `default` — An unexpected error response. --- [API](https://skmtc.dev/endorlabs/apis/endor-labs-rest-api-reference.md) · [All operations](https://skmtc.dev/endorlabs/apis/endor-labs-rest-api-reference/llms.txt) · [OpenAPI document](https://skmtc-service-production.skmtc.workers.dev/v1/apis/endorlabs/endor-labs-rest-api-reference/revisions/2fe1f84213b3/schema)