Apps

Update App Permissions

Changed on

Replaces the set of permissions the app requests from users when they install it. Requires a user session: the developer:update_app_authorization scope cannot be delegated to API keys. Sensitive permissions require step-up verification.

patch/apps/{id}/permissions

Request

  • Base URL: https://api.whop.com/api/v1
  • URL: https://api.whop.com/api/v1/apps/{id}/permissions
  • Auth: HTTP bearer

Request body

Example request

{
  "requested_permissions": [
    {
      "action": "company:basic:read",
      "is_required": true,
      "justification": "Reads basic account info to render the dashboard home."
    }
  ]
}

Response

requested permissions updated

app_store_descriptionstring nullable required

Detailed description shown on the app store's in-depth app page, or null when none has been set.

app_type'b2b_app' | 'b2c_app' | 'company_app' | 'component' | 'website' required

The type of end-user the app is built for.

base_urlstring nullable required

The production base URL where the app is hosted. null if no base URL is configured, if the caller lacks the developer:basic:read permission on the app's account, or on list responses, which never expose it.

businesses_created_countinteger required

Website businesses created from this app as a template.

businesses_created_logo_urlsstring[] required
businesses_with_recent_sales_countinteger required

Website businesses created from this app as a template that processed a payment in the last 24 hours. Recounted hourly, so it can be up to an hour behind.

dashboard_pathstring nullable required

URL path for the account dashboard view, or null when not configured.

descriptionstring nullable required

Short description shown in listings and search results, or null if none has been set.

discover_pathstring nullable required

URL path for the discover view, or null when not configured.

domain_idstring required

Subdomain identifier for the app's proxied URL, forming https://{domain_id}.apps.whop.com.

elements_usedstring[] required
experience_pathstring nullable required

URL path for the member-facing hub view, or null when not configured.

hosted_urlstring nullable required

Full URL where the app's hosted web build is served, or null if no route is claimed. DEPRECATED: Read domains instead.

idstring required

App ID, prefixed app_.

imported_from_urlstring nullable required

The address of the existing website this app was imported from, such as https://shop.example.com. null if the app was not imported from another site, or if the caller lacks the developer:basic:read permission on the app's account.

marketplace_status'not_available' | 'pending_review' | 'live_marketplace' | 'null' nullable required

Approval status of the app's product listing on the Whop app store, or null when the app has no associated product.

namestring required

Display name shown on the app store and in experience navigation.

oauth_client_type'public' | 'confidential' required

How the app authenticates at the OAuth token endpoint.

openapi_pathstring nullable required

URL path to the app's OpenAPI spec file, or null when not configured.

originstring nullable required

Full origin URL of the app's proxied domain, for example https://ab1c2d3e4f.apps.whop.com.

preview_tokenstring nullable required

A short-lived signed pass scoping the caller to this app's gated preview hosts — every build preview and the live dev-server sandbox. Add it to a preview host as the __whop_preview query param (or x-whop-preview-token header). null unless the caller is a team member who can read the app's developer settings.

product_idstring nullable required

ID of the app's product listing on the Whop app store, or null when the app has no associated product.

redirect_urisstring[] required
required_scopesstring[] required
routestring nullable required

Claimed subdomain route where hosted web builds are served (myapp for myapp.whop.site), or null if no route is claimed. DEPRECATED: Read domains instead.

secretsobject nullable required

The app's production secrets as an object of string values, injected into the hosted server runtime. null when the caller lacks the developer:update_app permission.

skills_pathstring nullable required

URL path to the app's skills directory, or null when not configured.

status'live' | 'unlisted' | 'hidden' required

Visibility on the Whop app store: live is publicly discoverable, unlisted is accessible only via direct link, hidden is not visible anywhere.

verifiedboolean required

Whether the app has been verified by Whop and is eligible for the featured apps section.

Example response

{
  "account": {
    "fees": {
      "crypto_swap_markup": {
        "fixed_fee_usd": 0,
        "percentage_fee": 3
      },
      "transfer_markup": {
        "fixed_fee_usd": 0,
        "percentage_fee": 0
      }
    },
    "id": "biz_xxxxxxxxxxxxxx",
    "logo_url": "https://whop-assets-example.s3.amazonaws.com/uploads/image/2026-01-01/xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx",
    "route": "shine-time-holdings",
    "title": "Shine Time Holdings"
  },
  "api_key": {
    "created_at": "2026-01-01T12:00:00.000Z",
    "token": "eyJhbGciOiJFUzI1NiJ9.xxxxxxxxxxxxxxxxxxxxxxxx.xxxxxxxxxxxxxxxxxxxxxxxx"
  },
  "app_store_description": "Shine Time Booking turns a whop into a booking calendar. Members pick a package, choose a slot that fits the day's route, and pay up front. A reminder goes out the night before and the receipt lands as soon as the job is signed off.",
  "app_type": "b2c_app",
  "banner_image": {
    "url": "https://whop-assets-example.s3.amazonaws.com/uploads/image/2026-01-01/xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx"
  },
  "base_url": "https://booking.shinetime.example",
  "businesses_created_count": 5,
  "businesses_created_logo_urls": [
    "https://whop-assets-example.s3.amazonaws.com/uploads/image/2026-01-01/xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx"
  ],
  "creator": {
    "id": "user_xxxxxxxxxxxxxx",
    "name": "Marcus Webb",
    "username": "marcuswebb"
  },
  "dashboard_path": "/dashboard/[companyId]",
  "default_api_key": {
    "id": "apik_xxxxxxxxxxxxxx",
    "name": "Default",
    "obfuscated_secret_key": "apik_xxxx....xxxx",
    "secret_key": "apik_xxxxxxxxxxxxxx_C0000_C_xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx"
  },
  "deployment": {
    "app_id": "app_xxxxxxxxxxxxxx",
    "estimated_duration_ms": 150000,
    "estimated_remaining_ms": 91000,
    "phase": "process_archive",
    "progress": 0.39,
    "started_at": 1767268800000,
    "status": "publishing"
  },
  "description": "Let members book a mobile detailing appointment without leaving your whop.",
  "discover_path": "/discover",
  "domain_id": "whopappdomain0000001",
  "domains": [
    {
      "domain": "from-template.whop.site",
      "id": "dom_xxxxxxxxxxxxxx",
      "status": "ready"
    }
  ],
  "elements_used": [
    "ads"
  ],
  "experience_path": "/experiences/[experienceId]",
  "hosted_url": "https://shine-time-booking.whop.site",
  "icon": {
    "url": "https://pub-xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx.r2.dev/custom-perk-icon.svg"
  },
  "id": "app_xxxxxxxxxxxxxx",
  "imported_from_url": "https://shinetime.example",
  "marketplace_status": "not_available",
  "name": "Shine Time Booking",
  "oauth_client_type": "public",
  "openapi_path": "/openapi.json",
  "origin": "https://whopappdomain0000001.apps.whop.com",
  "preview_token": "whop_preview_pass_example",
  "product_id": "prod_xxxxxxxxxxxxxx",
  "production_android_build": {
    "checksum": "xxxxxxxxxxxxxxxx",
    "file_url": "https://whop-assets-example.s3.amazonaws.com/uploads/image/2026-01-01/xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx",
    "id": "apbu_xxxxxxxxxxxxxx",
    "source_url": "https://whop-assets-example.s3.amazonaws.com/uploads/image/2026-01-01/xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx",
    "status": "approved"
  },
  "production_ios_build": {
    "checksum": "xxxxxxxxxxxxxxxx",
    "file_url": "https://whop-assets-example.s3.amazonaws.com/uploads/image/2026-01-01/xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx",
    "id": "apbu_xxxxxxxxxxxxxx",
    "source_url": "https://whop-assets-example.s3.amazonaws.com/uploads/image/2026-01-01/xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx",
    "status": "approved"
  },
  "production_web_build": {
    "checksum": "xxxxxxxxxxxxxxxx",
    "file_url": "https://whop-assets-example.s3.amazonaws.com/uploads/image/2026-01-01/xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx",
    "id": "apbu_xxxxxxxxxxxxxx",
    "source_url": "https://whop-assets-example.s3.amazonaws.com/uploads/image/2026-01-01/xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx",
    "status": "approved"
  },
  "redirect_uris": [
    "https://booking.shinetime.example/oauth/callback"
  ],
  "requested_permissions": [
    {
      "is_required": true,
      "justification": "Creates apps on behalf of the installing company.",
      "permission_action": {
        "action": "company:basic:read",
        "name": "company:basic:read"
      }
    }
  ],
  "required_scopes": [
    "read_user"
  ],
  "route": "shine-time-booking",
  "secrets": {
    "BOOKING_CALENDAR_ID": "cal_9f21"
  },
  "skills_path": "/skills",
  "status": "unlisted"
}

Changes

  • 7d2eaa643369Revision changes
    • breaking

      removed the required property from the response with the status

    • info

      response property hosted_url deprecated

    • info

      response property route deprecated

    • info

      added the required property to the response with the status

  • de951faea120Revision changes
    • warning

      added the new idle enum value to the // response property for the response status

    • warning

      added the new pending enum value to the // response property for the response status

    • warning

      added the new ready enum value to the // response property for the response status

    • warning

      added the new releasing enum value to the // response property for the response status

    • info

      removed the active enum value from the // response property for the response status

    • info

      removed the awaiting_payment enum value from the // response property for the response status

    • info

      removed the deleting enum value from the // response property for the response status

    • info

      removed the expired enum value from the // response property for the response status

    • info

      removed the failed enum value from the // response property for the response status

    • info

      removed the pending_verification enum value from the // response property for the response status

    • info

      removed the provisioning enum value from the // response property for the response status

    • info

      removed the registering enum value from the // response property for the response status

    • info

      removed the removed enum value from the // response property for the response status