---
title: "Update a signal"
method: PATCH
path: "/v1/signals/{signalKey}"
tags: ["Signals"]
---

# Update a signal

`PATCH /v1/signals/{signalKey}`

## Request

- Base URL: `https://api.trayo.ai`
- URL: `https://api.trayo.ai/v1/signals/{signalKey}`
- Auth: HTTP bearer

**Required permissions:** `settings:write`.

Updates create a new signal version. It takes effect on the next run that names the signal.

## Path parameters

- `signalKey` string, required

## Request body

- UpdateSignalDto: Every field is optional; only fields present are changed. `signalKey` and `type` are absent on purpose — the key is the resource's identity and sending either is a `validation_failed`. An edit takes effect on the next run that names the signal.
  - `detects` string
  - `salesIntent` string
  - `includes` string[]: Examples of what counts. For `job_change`, list every title and scope you would accept: a move matches a role the definition describes, or the company-wide chief who directly owns it (a Chief Accounting Officer for Corporate Controller), never another neighbouring title. A company-wide title such as CFO does not match a regional or divisional one (CFO, Latin America) unless you list that scope. Naming senior titles too (Chief Supply Chain Officer beside VP Logistics) makes the search look for them.
  - `excludes` string[]: Cases that never count: each one vetoes a match, except one that names another signal ("this belongs to X"), which sends the match to that signal instead.
  - `weight` integer

## Response `200`

The signal after the update.

- SignalDto
  - `signalKey` string, required: The stable public identifier. There is no separate row id.
  - `type` string, nullable, required
  - `entityType` string, required
  - `detects` string, required
  - `salesIntent` string, nullable, required
  - `includes` string[], required
  - `excludes` string[], required
  - `weight` number, required
  - `createdAt` string, date-time, required
  - `updatedAt` string, date-time, required

## Other responses

- `400`: Malformed body, or the body tried to set `signalKey`/`type`, which this route does not accept. `validation_failed` (`retry: fix_input`) — The request did not pass input validation: a missing or malformed body field, a bad `limit`, a path parameter that is not a UUID, a `signalKey` that already exists or is reserved. `message` lists every failed constraint; `param` names the first offending field when one can be identified.
- `401`: Missing, malformed, or incorrect bearer token. Every way authentication can fail returns the identical body, so do not try to infer which one it was, and do not repeat the call with the same key. `unauthorized` (`retry: do_not_retry`) — Missing, malformed, or incorrect bearer token. Identical body for every cause.
- `403`: The key grant and its owner's current workspace role must both include every scope required by the operation. `insufficient_scope` (`retry: do_not_retry`) — Scope denial details distinguish missing_key_scope (use a key granting every missing scope), owner_permission_limit (the owner needs the missing workspace permissions), and invalid_key_scope (replace the key with supported scopes). Membership and undeclared-route denials remain generic.
- `404`: `signal_not_found` (`retry: do_not_retry`) — No such signal key, or it is product-managed/person-entity and not addressable here.
- `429`: Every route is rate limited per workspace across REST, MCP, all keys and OAuth users, `GET /v1/whoami` included, so a balance poll competes with the work it is watching. For `rate_limited`, wait `Retry-After` seconds (also `details.retryAfterSeconds`), then send the same request once; do not retry sooner. `RateLimit-Limit`, `RateLimit-Remaining` and `RateLimit-Reset` describe the workspace's bucket, and they come back on successful responses too: read them and slow down BEFORE you are refused. A burst from one network can also be refused before the key is checked; that 429 carries `Retry-After` and no `RateLimit-*` headers. `rate_limited` (`retry: retry_later`) — The workspace or source network exhausted its request budget for one bucket. `details.retryAfterSeconds` (and `Retry-After` on REST) is the wait: wait that long, then retry the same request once. Do not poll or retry sooner; an early retry is refused again. If you cannot wait, stop and tell the user when to retry; do not fill the wait with other calls. `details.limit` and `details.bucket` name the exhausted budget. When present, RateLimit-* headers describe the active budget and reset.
- `500`: Something failed on our side. Nothing about the request needs changing. `internal_error` (`retry: retry_later`) — Something failed on our side. `message` never describes it — quote `requestId` when reporting. Retry with exponential backoff and GIVE UP after a few attempts: `retry_later` here does not mean the failure is known to be transient, only that nothing about your request needs changing. A request that fails this way repeatedly will not start working.

---

[API](https://skmtc.dev/trayo/apis/trayo-api.md) · [All operations](https://skmtc.dev/trayo/apis/trayo-api/llms.txt) · [OpenAPI document](https://skmtc.dev/trayo/apis/trayo-api/revisions/0af452dce6de?raw)