---
title: "Update"
method: PUT
path: "/v1/m2m/clients/{client_id}"
tags: ["M2M"]
---

# Update

`PUT /v1/m2m/clients/{client_id}`

## Request

- Base URL: `https://api.stytch.com`
- URL: `https://api.stytch.com/v1/m2m/clients/{client_id}`
- Auth: HTTP basic

Updates an existing M2M Client. You can use this endpoint to activate or deactivate an M2M Client by changing its `status`. A deactivated M2M Client will not be allowed to perform future token exchange flows until it is reactivated.

**Important:** Deactivating an M2M Client will not invalidate any existing JWTs issued to the client, only prevent it from receiving new ones.
To protect more-sensitive routes, pass a lower `max_token_age` value when[authenticating the token](https://stytch.com/docs/b2b/api/authenticate-m2m-token)[authenticating the token](https://stytch.com/docs/api/authenticate-m2m-token).

## Path parameters

- `client_id` string, required: The ID of the client.

## Request body

- ApiM2mV1M2mClientsUpdateRequest: Request type
  - `client_name` string: A human-readable name for the client.
  - `client_description` string: A human-readable description for the client.
  - `status` 'active' | 'inactive'
  - `scopes` string[]: An array of scopes assigned to the client.
  - `trusted_metadata` object: The `trusted_metadata` field contains an arbitrary JSON object of application-specific data. See the [Metadata](https://stytch.com/docs/api/metadata) reference for complete field behavior details.

## Response `200`

Successful response

- ApiM2mV1M2mClientsUpdateResponse
  - `request_id` string, required: Globally unique UUID that is returned with every API call. This value is important to log for debugging purposes; we may ask for this value to help identify a specific API call when helping you debug an issue.
  - `m2m_client` ApiM2mV1M2MClient, required
    - `client_id` string, required: The ID of the client.
    - `client_name` string, required: A human-readable name for the client.
    - `client_description` string, required: A human-readable description for the client.
    - `status` string, required: The status of the client - either `active` or `inactive`.
    - `scopes` string[], required: An array of scopes assigned to the client.
    - `client_secret_last_four` string, required: The last four characters of the client secret.
    - `trusted_metadata` object: An arbitrary JSON object for storing application-specific data.
    - `next_client_secret_last_four` string: The last four characters of the `next_client_secret`. Null if no `next_client_secret` exists.
  - `status_code` integer, required: The HTTP status code of the response. Stytch follows standard HTTP response status code patterns, e.g. 2XX values equate to success, 3XX values are redirects, 4XX are client errors, and 5XX are server errors.

## Other responses

- `400`: Bad request
- `401`: Unauthorized
- `429`: Too Many Requests
- `500`: Internal server error

## Changes

- **2026-03-07** `110f26a94e5b`: 1 info
  - endpoint added
- **2026-03-06** `9cab20b8eca7`: 1 breaking
  - api path removed without deprecation
- **2026-01-09** `7dfcc14e566c`: 2 breaking, 1 warning
  - the `trusted_metadata` request property type changed from `string` to `object`
  - the `m2m_client/trusted_metadata` response's property type changed from `string` to `object` for status `200`
  - removed the request property `client_id`
- **2025-11-03** `b2acbf387799`: 1 breaking
  - added the new required request property `client_id`
- **2025-10-24** `69e827881158`: 1 warning
  - removed the request property `client_id`

[Operation history](https://skmtc.dev/stytch/apis/stytch-api/changes/v1/m2m/clients/:client_id/put.md)

---

[API](https://skmtc.dev/stytch/apis/stytch-api.md) - [All operations](https://skmtc.dev/stytch/apis/stytch-api/llms.txt) - [OpenAPI document](https://skmtc.dev/stytch/apis/stytch-api/revisions/6d1ff7474803?raw)