---
title: "Update a resource"
method: PATCH
path: "/v1/projects/{project}/resources/{resource}"
tags: ["Resources"]
---

# Update a resource

`PATCH /v1/projects/{project}/resources/{resource}`

## Request

- Base URL: `https://api.subscriby.net`
- URL: `https://api.subscriby.net/v1/projects/{project}/resources/{resource}`
- Auth: HTTP bearer

```bash
curl -X PATCH https://api.subscriby.net/v1/projects/$PROJECT_ID/resources/$RESOURCE_ID \
  -H "Authorization: Bearer $SUBSCRIBY_TOKEN" \
  -H "Idempotency-Key: $(uuidgen)" \
  -H "Content-Type: application/json" \
  -d '{ "title": "Members lounge (VIP)" }'
```

Partial by design: only the fields present in the body change, so a title-only update leaves the description exactly as stored, filtered HTML included, and logs no description edit. `kind` and `space` are not writable here: a resource keeps its kind for life, and its place moves only through the connector.

Answers `200` with the resource. When at least one field actually changed, `project.resource.updated` fires once with a `changes` map of `{field: {from, to}}`; a body that restates the stored values writes nothing and emits nothing.

## Path parameters

- `project` string, uuid, required
- `resource` string, uuid, required

## Headers

- `Idempotency-Key` string, uuid, required

## Request body

- UpdateResourceRequest: The changes to a resource. Every field is optional and an omitted one keeps its stored value. `kind` and `space` are not writable: a resource keeps its kind for life, and its place moves only through the connector.
  - `title` string: The resource's name on plan cards, 5 to 255 characters.
  - `description` string, nullable: What the resource is, up to 1,000 characters, the same HTML filter as create; null clears it.
  - `active` boolean: Whether plans grant it; the activate and deactivate endpoints flip the same switch.

## Response `200`

The resource after the change.

- object
  - `data` ResourceResource, required: A resource a project sells access to: a place a connector gates, or a manual perk the creator hands over by hand.
    - `id` string, required: The resource's id.
    - `project_id` string, required: The project the resource belongs to.
    - `kind` string, required: `manual` for a perk the creator hands over by hand, otherwise `connector:kind` as the connector directory lists each connector's `resource_kinds`.
    - `connector` string, nullable, required: The connector key the place is on; null for a manual perk.
    - `space` object, nullable, required: The place the resource is bound to. Null for a manual perk and for a place-kind resource that was unlinked.
      - `id` string, required: The space's id.
      - `external_id` string, required: The platform's own id for the place.
      - `title` string, nullable, required: The place's title as the connector last read it.
    - `title` string, required: The resource's name on plan cards; for a linked place, the place's title at link time.
    - `description` string, nullable, required: Up to 1,000 characters of well-formed HTML, shown as a perk beside the title; null when none.
    - `active` boolean, required: Whether plans grant it right now. An inactive resource keeps its link and its plans, but new members do not receive it.
    - `created_at` string, nullable, required: When the resource was created, ISO 8601.
    - `updated_at` string, nullable, required: When the resource last changed, ISO 8601.

## Other responses

- `400`: `IDEMPOTENCY_KEY_MISSING`: every write needs an `Idempotency-Key` header. Send a fresh UUID per distinct operation.
- `401`: `AUTHENTICATION_REQUIRED`: the request carries no bearer token, or one that is revoked, malformed, or minted for another environment (an `sbt_test_` token on production).
- `403`: `TOKEN_MISSING_ABILITY`: the token is valid but does not carry the ability this endpoint requires; `error.context.required_ability` names the one to grant. An endpoint that also checks who owns a row or which tier the account is on answers `FORBIDDEN`, `TEAM_TIER_REQUIRED` or `CONNECTOR_TIER_REQUIRED` with the same status, and says so in its own description.
- `404`: `RESOURCE_NOT_FOUND`: an id in the path names nothing the token can see. `TENANT_MISMATCH`: the project sits outside the token's `scope:project:` allow-list, or the token carries no team scope. Both answer 404 rather than 403 so that existence outside the token's scope cannot be inferred.
- `409`: `IDEMPOTENCY_KEY_REUSED`: the key was already used in the last 24 hours with a different request body.
- `422`: `VALIDATION_FAILED`: the payload broke a rule, and `error.fields` maps each offending key to its messages. A refusal from the domain, such as a plan that cannot go on sale or a member who cannot be removed, uses the same code with `error.message` saying why and no `fields`. On this endpoint: `VALIDATION_FAILED`: when `title` is outside 5 to 255 characters or `description` exceeds 1,000 characters.
- `425`: `IDEMPOTENCY_REPLAY_IN_PROGRESS`: the first request with this key is still running; retry in a few seconds and the original response is replayed.
- `429`: `RATE_LIMITED`: the token has spent its 300 requests a minute or 10,000 an hour; `Retry-After` says when the next one is accepted.

---

[API](https://skmtc.dev/memberpass/apis/subscriby-rest-api.md) · [All operations](https://skmtc.dev/memberpass/apis/subscriby-rest-api/llms.txt) · [OpenAPI document](https://skmtc.dev/memberpass/apis/subscriby-rest-api/revisions/59c4df91d764?raw)