---
title: "Update an attached source's placement on the stack"
method: PUT
path: "/v1/stacks/{stack_id}/sources/{source_id}"
tags: ["Stacks"]
---

# Update an attached source's placement on the stack

`PUT /v1/stacks/{stack_id}/sources/{source_id}`

## Request

- Base URL: `https://statusstack.com/api`
- URL: `https://statusstack.com/api/v1/stacks/{stack_id}/sources/{source_id}`
- Auth: HTTP bearer

## Request body

- StackSourcePlacement: Where an attached source sits on the stack. Carried on the stack/source pivot.
  - `sort_order` integer

## Response `200`

Placement updated

- object
  - `message` string

## Other responses

- `401`: No bearer credentials, or credentials that do not resolve to an API key or Sanctum token. Produced by `ApiAuthentication` ahead of the route, so every operation in the v1 group can return it.
- `403`: The API key lacks the required permission, or a policy denied the action. The two come from different layers and return different bodies, so this is a union rather than one shape.
- `404`: No such stack, or the addressed source is not attached to it. Unlike the operations that use `StackNotFound`, these controllers authorize through the policy alone without the scope guard, so an existing stack belonging to another team returns 403 here, not a concealed 404.
- `422`: The request body failed validation, or the write would exceed the organization's quota — `CheckQuota` also answers 422, with its own body.
- `429`: The `v1-api` rate limit (120 requests per minute) was exceeded. Applies to every operation in the v1 group.

---

[API](https://skmtc.dev/statusstack/apis/statusstack-api.md) - [All operations](https://skmtc.dev/statusstack/apis/statusstack-api/llms.txt) - [OpenAPI document](https://skmtc.dev/statusstack/apis/statusstack-api/revisions/a5fabf6ac5e4?raw)