---
title: "Amend the live allow-list (hot-syncs to all joined apps); 409 on stale version"
method: PATCH
path: "/class-management/sessions/{id}/allowlist"
tags: ["class-management"]
---

# Amend the live allow-list (hot-syncs to all joined apps); 409 on stale version

`PATCH /class-management/sessions/{id}/allowlist`

## Request

- Base URL: `https://api.focusbear.io` (the document declares no server; this is the origin it was published from)
- URL: `https://api.focusbear.io/class-management/sessions/{id}/allowlist`
- Auth: HTTP bearer

## Path parameters

- `id` string, uuid, required

## Request body

- AmendAllowlistDto
  - `allowed_apps` string[], required
  - `allowed_urls` string[], required
  - `app_identities` AppIdentityDto[]: Platform identities for `allowed_apps` entries, keyed by `entry`. Optional: the server fills in common apps from the catalog, and on amend an omitted list keeps the stored identities.
    - `entry` string, required: The allowed_apps value this identity describes, verbatim
    - `name` string
    - `common_app_id` string: Id of the GET /common-apps entry this app was picked from
    - `mac_bundle_id` string
    - `windows_identity` WindowsAppIdentityDto
      - `exe` string, required
      - `exes` string[]: Every executable the app ships as, exe included, when it has more than one
      - `publisher` string: Authenticode signer organisation
  - `ai_blocking_enabled` boolean: Hot-toggle for the student-side AI relevance check (Mac-App#2092). When present the session field is updated in the same transactional write as the allow-list; when omitted the current value is kept.
  - `ai_contest_enabled` boolean: Hot-toggle for student AI contests, same semantics as `ai_blocking_enabled` (omitted = keep).
  - `block_bypass_sites` boolean: Hot-toggle for blocking bypass sites, same semantics as `ai_blocking_enabled` (omitted = keep).
  - `expected_allowlist_version` number: Optimistic concurrency token: when set and stale, the request fails with 409 Conflict so concurrent teacher tabs don't silently clobber each other.

## Response `200`

- object

---

[API](https://skmtc.dev/focusbear/apis/focusbear-api.md) - [All operations](https://skmtc.dev/focusbear/apis/focusbear-api/llms.txt) - [OpenAPI document](https://skmtc.dev/focusbear/apis/focusbear-api/revisions/3a83a3b9a811?raw)