---
title: "PATCH /v1/control/applications/{application_id}/oauth-resources/{resource_id}"
method: PATCH
path: "/v1/control/applications/{application_id}/oauth-resources/{resource_id}"
tags: ["Control"]
---

# PATCH /v1/control/applications/{application_id}/oauth-resources/{resource_id}

`PATCH /v1/control/applications/{application_id}/oauth-resources/{resource_id}`

## Request

- Base URL: `/` (relative, and the document was published on a file host, not at the API’s origin)
- URL: `/v1/control/applications/{application_id}/oauth-resources/{resource_id}`
- Auth: one of:
  - HTTP bearer
  - API key in cookie `p93_control_access`

Omitted fields remain unchanged. Supplied client_ids and capabilities replace the complete corresponding arrays, including nested permission lists.

## Headers

- `If-Match` string, required

## Request body

- UpdateOAuthResource: Partial configuration update. Omitted fields are unchanged; supplied arrays replace the complete array. Null is not accepted.
  - `uri` string, uri
  - `name` string
  - `enabled` boolean
  - `allow_client_metadata` boolean
  - `client_ids` string[]
  - `capabilities` OAuthResourceCapability[]
    - `key` string, required: Relative capability key, unique within the resource.
    - `name` string, required
    - `context` 'personal' | 'workspace', required
    - `permissions` string[], required: Required non-null permission list. An empty array permits identity-only access based on the live user and selected personal or workspace context, without requiring scopes or default roles.

## Response `200`

OAuth resource updated.

- OAuthResource
  - `id` string, uuid, required
  - `application_id` string, uuid, required
  - `uri` string, uri, required
  - `name` string, required
  - `enabled` boolean, required
  - `allow_client_metadata` boolean, required
  - `client_ids` string[], required
  - `capabilities` OAuthResourceCapability[], required
    - `key` string, required: Relative capability key, unique within the resource.
    - `name` string, required
    - `context` 'personal' | 'workspace', required
    - `permissions` string[], required: Required non-null permission list. An empty array permits identity-only access based on the live user and selected personal or workspace context, without requiring scopes or default roles.
  - `version` integer, required
  - `created_at` string, date-time, required
  - `updated_at` string, date-time, required

## Other responses

- `403`: RFC 9457 problem
- `404`: RFC 9457 problem
- `409`: RFC 9457 problem
- `412`: RFC 9457 problem
- `422`: RFC 9457 problem
- `428`: RFC 9457 problem

## Changes

- **2026-10-18** `7c63ef49acf0`: 1 info
  - endpoint added

[Operation history](https://skmtc.dev/supaapps/apis/platform93-api/changes/v1/control/applications/:application_id/oauth-resources/:resource_id/patch.md)

---

[API](https://skmtc.dev/supaapps/apis/platform93-api.md) · [All operations](https://skmtc.dev/supaapps/apis/platform93-api/llms.txt) · [OpenAPI document](https://skmtc.dev/supaapps/apis/platform93-api/revisions/7c63ef49acf0?raw)