---
title: "Update a file's visibility / grantees / label / description / tags"
method: PATCH
path: "/api/files/{id}"
tags: ["files"]
---

# Update a file's visibility / grantees / label / description / tags

`PATCH /api/files/{id}`

## Request

- Base URL: `https://www.immersivecommons.com`
- URL: `https://www.immersivecommons.com/api/files/{id}`
- Auth: HTTP bearer

Clerk session or agt_ token with `files:write` (live tier re-checked). Uploader or operator only. ONLY the five keys below are read off the body — owner, folder, id, size, filename, content type and the blob pointers are structurally immutable, so sending them changes nothing rather than being rejected.

## Path parameters

- `id` string, required

## Request body

- FileUpdateRequest: Partial update. Only these five keys are ever read — anything else in the body is ignored, not rejected.
  - `visibility` 'private' | 'ic-members' | 'grantees'
  - `grantees` string[]
  - `label` string
  - `description` string
  - `tags` string[]

## Response `200`

The updated file.

- FileUpdateResponse
  - `ok` boolean, required
  - `file` FilePublic, required: The caller-facing projection of a vault file (lib/files-types.ts::FilePublic). Blob coordinates are never part of it — bytes come from GET /api/files/{id}/download.
    - `id` string, required
    - `filename` string, required
    - `contentType` string, required
    - `size` integer, required: Bytes.
    - `sha256` string
    - `folder_id` string, nullable, required: Containing folder, or null at the vault root.
    - `uploadedBy` string, required: Clerk user id of the uploader.
    - `uploadedByName` string
    - `uploadedAt` string, date-time, required
    - `visibility` 'private' | 'ic-members' | 'grantees', required
    - `grantees` string[], required: Clerk user ids explicitly admitted to this file.
    - `label` string
    - `description` string
    - `tags` string[], required
    - `mine` boolean, required: True iff the requesting caller uploaded this file.
    - `can_manage` boolean, required: True iff the requesting caller may update, delete, or re-share it.

## Other responses

- `400`: Invalid JSON or a rejected field value.
- `401`: No auth.
- `403`: Not the uploader and not an operator.
- `404`: No such file.

---

[API](https://skmtc.dev/immersivecommons/apis/immersive-commons-agent-rest-api.md) · [All operations](https://skmtc.dev/immersivecommons/apis/immersive-commons-agent-rest-api/llms.txt) · [OpenAPI document](https://skmtc.dev/immersivecommons/apis/immersive-commons-agent-rest-api/revisions/be67c1f67c27?raw)