---
title: "Update Project Locked Tags Endpoint"
method: PUT
path: "/updateProjectLockedTags"
---

# Update Project Locked Tags Endpoint

`PUT /updateProjectLockedTags`

## Request

- Base URL: `https://api.pavoot.com` (the document declares no server; this is the origin it was published from)
- URL: `https://api.pavoot.com/updateProjectLockedTags`
- Auth: none declared

Replaces the project's locked tags with the body's list. Body: { projectId: number, lockedTags: string[] }.

Gated on 'settings.manage.lockedTags' (migration 026). Before that this endpoint was gated
only by require_project_access, so ANY project member — a photographer included — could
rewrite the locked-tag list and expose images the organizers had deliberately withheld.
require_task_or_403 also enforces project membership, so it replaces that check.

## Response `200`

Successful Response

- unknown

---

[API](https://skmtc.dev/pavoot/apis/pavoot-api.md) - [All operations](https://skmtc.dev/pavoot/apis/pavoot-api/llms.txt) - [OpenAPI document](https://skmtc.dev/pavoot/apis/pavoot-api/revisions/8c0cd91c2a05?raw)