---
title: "Update App"
method: PATCH
path: "/partner/products/{product_id}/app"
tags: ["App"]
---

# Update App

`PATCH /partner/products/{product_id}/app`

## Path parameters

- `product_id` string, required

## Request body

- AppSanitizer
  - `handshake_url` string — URL where Hint POSTs the handshake payload during embed bootstrapping. Must be https.
  - `localhost_handshake_url` string — HTTP localhost URL used in place of `handshake_url` when the current session has localhost mode enabled. Sandbox partners only.
  - `default_admin_role` string — Role name to apply to hinters and to admin users by default. Must match the `name` of one of the entries in partner_roles.
  - `default_non_admin_role` string — Role name to apply to non-admin users by default. Must match the `name` of one of the entries in partner_roles.
  - `prepopulate_role_mappings` boolean — When true, new practice→role mappings are prepopulated with the default role.
  - `partner_roles` AppSanitizerPartnerRoleSanitizer[] — List of partner-defined roles. Each entry has a `name` (unique, required) and a `description` (free text, optional).
    - `name` string, required — Stable identifier for the role. Required; must be unique across the app's roles.
    - `description` string — Free-form description of what the role grants.
  - `browser_allow_list` string[] — Browser capabilities delegated to the app's embedded iframes via the Permissions Policy `allow` attribute. Supported values: `camera`, `microphone`, `geolocation`. Defaults to `[]` (no delegation). The end user still sees the browser's own permission prompt for each capability. Changes apply the next time a surface is embedded — already-open surfaces must be reloaded.

## Response `200`

Successful response

- PublicAppBlueprintOne
  - `id` string
  - `browser_allow_list` string[]
  - `default_admin_role` string
  - `default_non_admin_role` string
  - `handshake_url` string
  - `localhost_handshake_url` string
  - `name` string
  - `prepopulate_role_mappings` boolean
  - `status` string
  - `partner_roles` PublicPartnerRoleBlueprintOne[]
    - `name` string
    - `description` string
  - `surfaces` PublicAppSurfaceBlueprintOne[]
    - `id` string
    - `source_url` string
    - `localhost_source_url` string
    - `type` string
    - `interaction_title` string
    - `interaction_description` string
    - `interaction_type` string
    - `core_page_icon_url` string
    - `core_page_icon_label` string
    - `core_page_auto_adjust_height` boolean
    - `clinical_chart_icon_url` string
    - `clinical_chart_icon_label` string
    - `settings_label` string

---

[API](https://skmtc.dev/hint/apis/partner-endpoints.md) · [All operations](https://skmtc.dev/hint/apis/partner-endpoints/llms.txt) · [OpenAPI document](https://skmtc-service-production.skmtc.workers.dev/v1/apis/hint/partner-endpoints/revisions/a92ae2a6fa90/schema)