--- title: "Update workload" method: POST path: "/api/v1beta/workloads/{name}/edit" tags: ["workloads"] --- # Update workload `POST /api/v1beta/workloads/{name}/edit` Update an existing workload configuration ## Path parameters - `name` string, required ## Request body - union - object - V1UpdateRequest — Request to update an existing workload (name cannot be changed) - `authz_config` string — Authorization configuration - `cmd_arguments` string[] — Command arguments to pass to the container - `env_vars` object — Environment variables to set in the container - `group` string — Group name this workload belongs to - `headers` RegistryHeader[] - `choices` string[] — Choices provides a list of valid values for the header (optional) - `default` string — Default is the value to use if the header is not explicitly provided Only used for non-required headers - `description` string — Description is a human-readable explanation of the header's purpose - `name` string — Name is the header name (e.g., X-API-Key, Authorization) - `required` boolean — Required indicates whether this header must be provided If true and not provided via command line or secrets, the user will be prompted for a value - `secret` boolean — Secret indicates whether this header contains sensitive information If true, the value will be stored as a secret rather than as plain text - `host` string — Host to bind to - `image` string — Docker image to use - `network_isolation` boolean — Whether network isolation is turned on. This applies the rules in the permission profile. - `oauth_config` V1RemoteOAuthConfig — OAuth configuration for remote server authentication - `authorize_url` string — OAuth authorization endpoint URL (alternative to issuer for non-OIDC OAuth) - `bearer_token` SecretsSecretParameter — Bearer token for authentication (alternative to OAuth) - `name` string - `target` string - `callback_port` integer — Specific port for OAuth callback server - `client_id` string — OAuth client ID for authentication - `client_secret` SecretsSecretParameter — Bearer token for authentication (alternative to OAuth) - `name` string - `target` string - `issuer` string — OAuth/OIDC issuer URL (e.g., https://accounts.google.com) - `oauth_params` object — Additional OAuth parameters for server-specific customization - `resource` string — OAuth 2.0 resource indicator (RFC 8707) - `scopes` string[] — OAuth scopes to request - `skip_browser` boolean — Whether to skip opening browser for OAuth flow (defaults to false) - `token_url` string — OAuth token endpoint URL (alternative to issuer for non-OIDC OAuth) - `use_pkce` boolean — Whether to use PKCE for the OAuth flow - `oidc` V1OidcOptions — OIDC configuration options - `audience` string — Expected audience - `client_id` string — OAuth2 client ID - `client_secret` string — OAuth2 client secret - `introspection_url` string — Token introspection URL for OIDC - `issuer` string — OIDC issuer URL - `jwks_url` string — JWKS URL for key verification - `scopes` string[] — OAuth scopes to advertise in well-known endpoint (RFC 9728) - `permission_profile` PermissionsProfile — PermissionProfile is the permission profile to use - `name` string — Name is the name of the profile - `network` PermissionsNetworkPermissions — Network defines network permissions - `inbound` PermissionsInboundNetworkPermissions — Inbound defines inbound network permissions - `allow_host` string[] — AllowHost is a list of allowed hosts for inbound connections - `mode` string — Mode specifies the network mode for the container (e.g., "host", "bridge", "none") When empty, the default container runtime network mode is used - `outbound` PermissionsOutboundNetworkPermissions — Outbound defines outbound network permissions - `allow_host` string[] — AllowHost is a list of allowed hosts - `allow_port` integer[] — AllowPort is a list of allowed ports - `insecure_allow_all` boolean — InsecureAllowAll allows all outbound network connections - `privileged` boolean — Privileged indicates whether the container should run in privileged mode When true, the container has access to all host devices and capabilities Use with extreme caution as this removes most security isolation - `read` string[] — Read is a list of mount declarations that the container can read from These can be in the following formats: - A single path: The same path will be mounted from host to container - host-path:container-path: Different paths for host and container - resource-uri:container-path: Mount a resource identified by URI to a container path - `write` string[] — Write is a list of mount declarations that the container can write to These follow the same format as Read mounts but with write permissions - `proxy_mode` string — Proxy mode to use - `proxy_port` integer — Port for the HTTP proxy to listen on - `secrets` SecretsSecretParameter[] — Secret parameters to inject - `name` string - `target` string - `target_port` integer — Port to expose from the container - `tools` string[] — Tools filter - `tools_override` object — Tools override - `transport` string — Transport configuration - `trust_proxy_headers` boolean — Whether to trust X-Forwarded-* headers from reverse proxies - `url` string — Remote server specific fields - `volumes` string[] — Volume mounts ## Response `200` OK - V1CreateWorkloadResponse — Response after successfully creating a workload - `name` string — Name of the created workload - `port` integer — Port the workload is listening on ## Other responses - `400` — Bad Request - `404` — Not Found ## Changes - **2026-01-29** `ff6ce8dd8f3a` — 1 breaking, 1 info - removed `#/components/schemas/pkg_api_v1.updateRequest` from the request body `oneOf` list - added `#/components/schemas/v1.updateRequest` to the request body `oneOf` list [Change history](https://skmtc.dev/stacklok/apis/toolhive-api/changes/api/v1beta/workloads/:name/edit/post.md) --- [API](https://skmtc.dev/stacklok/apis/toolhive-api.md) · [All operations](https://skmtc.dev/stacklok/apis/toolhive-api/llms.txt) · [OpenAPI document](https://skmtc-service-production.skmtc.workers.dev/v1/apis/stacklok/toolhive-api/revisions/ff6ce8dd8f3a/schema)