---
title: "Update application"
method: PATCH
path: "/zones/{zoneId}/applications/{id}"
tags: ["Applications"]
---

# Update application

`PATCH /zones/{zoneId}/applications/{id}`

Updates an Application's configuration and metadata

## Path parameters

- `zoneId` string, required
- `id` string, required

## Request body

- IamApplicationUpdate — Schema for updating an existing application
  - `name` string, safe-text — Human-readable name. Must not contain HTML tags (e.g. `<script>`, `<div>`) or control characters.
  - `description` string, safe-text, nullable — Human-readable description. Must not contain HTML tags (e.g. `<script>`, `<div>`) or control characters.
  - `identifier` string, safe-text — User specified identifier, unique within the zone. Must not contain HTML tags (e.g. `<script>`, `<div>`) or control characters.
  - `metadata` IamMetadataUpdate, nullable — Entity metadata (set to null or {} to remove metadata)
    - `docs_url` string, uri, nullable — Documentation URL (set to null to unset)
    - `icon_url` string, uri, nullable — Icon URL (set to null to unset)
  - `protocols` IamApplicationProtocolUpdate, nullable — Protocol-specific configuration for application update
    - `oauth2` IamApplicationOAuth2ProtocolUpdate, nullable — OAuth 2.0 protocol configuration for application update
      - `redirect_uris` string[], nullable — OAuth 2.0 redirect URIs for this application (set to null or [] to unset)
      - `post_logout_redirect_uris` string[], nullable — OAuth 2.0 post-logout redirect URIs for this application (set to null or [] to unset)
  - `consent` 'implicit' | 'required' — Consent mode for the application. 'implicit' means consent is automatically granted, 'required' means explicit user consent is needed.

## Response `200`

An Application is a software system with an associated identity that can access Resources. It may act on its own behalf (machine-to-machine) or on behalf of a user (delegated access).

- IamApplication — An Application is a software system with an associated identity that can access Resources. It may act on its own behalf (machine-to-machine) or on behalf of a user (delegated access).
  - `id` string, required — Unique identifier of the application
  - `organization_id` string, required — Organization that owns this application
  - `zone_id` string, required — Zone this application belongs to
  - `slug` string, required — URL-safe identifier, unique within the zone
  - `identifier` string, required — User specified identifier, unique within the zone
  - `name` string, required — Human-readable name
  - `description` string, nullable — Human-readable description
  - `metadata` IamMetadata — Entity metadata
    - `docs_url` string, uri — Documentation URL
    - `icon_url` string, uri — Icon URL
  - `protocols` object, nullable — Protocol-specific configuration
    - `oauth2` IamApplicationOAuth2Protocol, nullable — OAuth 2.0 protocol configuration
      - `redirect_uris` string[], nullable — OAuth 2.0 redirect URIs for this application
      - `post_logout_redirect_uris` string[], nullable — OAuth 2.0 post-logout redirect URIs for this application
  - `dependencies_count` integer, required — Number of resource dependencies
  - `owner_type` 'platform' | 'customer', required — Who owns this application. Platform-owned applications cannot be modified via API.
  - `consent` 'implicit' | 'required', required — Consent mode for the application. 'implicit' means consent is automatically granted, 'required' means explicit user consent is needed.
  - `created_at` string, date-time, required — Entity creation timestamp
  - `updated_at` string, date-time, required — Entity update timestamp

## Other responses

- `400` — Error response
- `403` — Error response
- `404` — Error response
- `409` — Error response
- `default` — Error response

## Changes

- **2026-08-26** `d65d51379d93` — 4 info
  - added the non-success response with the status `400`
  - added the non-success response with the status `403`
  - added the non-success response with the status `404`
  - added the non-success response with the status `409`
- **2026-07-01** `2f5033ed4491` — 2 info
  - added the new optional request property `metadata/icon_url`
  - added the optional property `metadata/icon_url` to the response with the `200` status
- **2026-04-20** `932699a5ea16` — 3 breaking, 2 info
  - the `description` request property type/format changed from `string`/`` to `string`/`safe-text`
  - the `identifier` request property type/format changed from `string`/`` to `string`/`safe-text`
  - the `name` request property type/format changed from `string`/`` to `string`/`safe-text`
  - added the new optional request property `consent`
  - …1 more
- **2026-03-16** `d3d69f45bfed` — 2 warning, 3 info
  - removed the request property `traits`
  - removed the optional property `traits` from the response with the `200` status
  - the endpoint scheme security `OAuth2` was added to the API
  - the endpoint scheme security `bearerAuth` was added to the API
  - …1 more
- **2026-03-09** `cb43483cd1b3` — 1 info
  - added the required property `owner_type` to the response with the `200` status

[Change history](https://skmtc.dev/keycardai/apis/untitled-api/changes/zones/:zoneId/applications/:id/patch.md)

---

[API](https://skmtc.dev/keycardai/apis/untitled-api.md) · [All operations](https://skmtc.dev/keycardai/apis/untitled-api/llms.txt) · [OpenAPI document](https://skmtc-service-production.skmtc.workers.dev/v1/apis/keycardai/untitled-api/revisions/d65d51379d93/schema)