---
title: "Update an existing tool"
method: PATCH
path: "/tools/{name}"
tags: ["Tools"]
---

# Update an existing tool

`PATCH /tools/{name}`

## Request

- Base URL: `https://api.mnemom.ai/v1`
- URL: `https://api.mnemom.ai/v1/tools/{name}`
- Auth: one of:
  - HTTP bearer
  - API key in header `X-Mnemom-Api-Key`

**Authorization: platform admin only.** Allowed callers: a Mnemom staff session (JWT or cookie whose role is `mnemom_staff`), or an API key carrying the `admin:platform` scope whose owner is re-verified as Mnemom staff on every request. Everyone else gets 403 `Admin access required` — that includes org owners and org admins of any tenant, ordinary users, and API keys without `admin:platform` (or whose owner is no longer staff). The `BearerAuth` / `ApiKeyAuth` schemes say how the caller authenticates, not who is allowed; the platform-admin check runs before the body is read, so a non-admin never reaches validation. An unauthenticated call gets 401.

Updates one or more user-editable fields. Idempotency-Key required (400 when absent; 409 while a request with the same key is still in flight; 422 when the key was already used with a different body). Version bumps only when content_hash changes. Immutable fields (name, version, content_hash, deprecated_at) are rejected with structured 400 errors. Bodies over the size cap get 413.

## Headers

- `Idempotency-Key` string, required

## Request body

- object
  - `class` 'read' | 'internal_write' | 'consequential_internal_write' | 'consequential_external_write' | 'comms_internal' | 'comms_external' | 'engineering_attestation' | 'governance_write': 8-entry action class taxonomy per mnemom-contracts/tool-manifest/v1.yaml. V7 gateway hooks bind on this for class-scoped enforcement.
  - `domain` 'financial' | 'engineering' | 'intelligence' | 'growth' | 'operations' | 'governance' | 'comms' | 'identity' | 'security': 9-entry domain taxonomy. Used by domain-scoped value declarations like policy_attentiveness(domain: financial).
  - `description` string, nullable
  - `display_name` string, nullable
  - `schema` object, nullable: OpenAPI fragment / JSON Schema for the tool parameters. Populated when the tool is imported via OpenAPI spec.
  - `source_connector` string, nullable

## Response `200`

Tool updated.

- object
  - `name` string, required: Globally unique tool name. Convention: `<connector>_<verb>_<noun>` (e.g. `campfire_create_chart_account`). Org-scoped tools use the reserved `org:<id>:` prefix.
  - `display_name` string, nullable
  - `description` string, nullable
  - `class` 'read' | 'internal_write' | 'consequential_internal_write' | 'consequential_external_write' | 'comms_internal' | 'comms_external' | 'engineering_attestation' | 'governance_write', required: 8-entry action class taxonomy per mnemom-contracts/tool-manifest/v1.yaml. V7 gateway hooks bind on this for class-scoped enforcement.
  - `domain` 'financial' | 'engineering' | 'intelligence' | 'growth' | 'operations' | 'governance' | 'comms' | 'identity' | 'security', required: 9-entry domain taxonomy. Used by domain-scoped value declarations like policy_attentiveness(domain: financial).
  - `schema` object, nullable: OpenAPI fragment / JSON Schema for the tool parameters. Populated when the tool is imported via OpenAPI spec.
  - `source_connector` string, nullable
  - `deprecated_at` string, date-time, nullable
  - `content_hash` string, nullable
  - `version` integer, required
  - `created_at` string, date-time, required
  - `updated_at` string, date-time, required

## Other responses

- `400`: Bad request
- `401`: Authentication required
- `403`: The caller is authenticated but is not a platform admin (Mnemom staff, or an `admin:platform` API key whose owner is still staff). Returned to every other caller, whatever their role in any org.
- `404`: Resource not found
- `409`: Resource conflict — the request cannot proceed because of a current state conflict (e.g., resource already exists, version mismatch, in-flight idempotency key with a different body).
- `413`: Request body exceeded the per-endpoint size cap. Cards-as-primitive sub-resource verbs cap each primitive body at 64 KiB; full-card PUTs cap at 128 KiB (alignment) / 64 KiB (protection).
- `422`: Request was well-formed but semantically invalid (e.g., business-rule validation failure, malformed YAML inside a JSON payload).
- `429`: Rate-limit exceeded. The global per-IP limiter (100 requests/minute, applied to every `/v1/*` route) rejected this request. Back off until the window resets — `Retry-After` carries the cooldown in seconds and `X-RateLimit-Reset` the absolute reset time.
- `500`: Server error — request was well-formed but the server failed to fulfill it. Typically a downstream dependency (DB / RPC / external API) returned an unexpected error.

---

[API](https://skmtc.dev/mnemom/apis/mnemom-api.md) · [All operations](https://skmtc.dev/mnemom/apis/mnemom-api/llms.txt) · [OpenAPI document](https://skmtc.dev/mnemom/apis/mnemom-api/revisions/274b7a6ea182?raw)