--- title: "Update app" method: PATCH path: "/apps/{id}" tags: ["Apps"] --- # Update app `PATCH /apps/{id}` Update the settings, metadata, or status of an existing app on the Whop developer platform. Required permissions: - `developer:update_app` - `developer:manage_api_key` ## Path parameters - `id` string, required ## Request body - object — Parameters for UpdateApp - `app_store_description` string, nullable — The detailed description shown on the app store's in-depth app view page. - `app_type` 'b2b_app' | 'b2c_app' | 'company_app' | 'component' — The type of end-user an app is built for - `base_url` string, nullable — The base production URL where the app is hosted, such as 'https://myapp.example.com'. - `dashboard_path` string, nullable — The URL path for the company dashboard view of the app, such as '/dashboard'. - `description` string, nullable — A short description of the app shown in listings and search results. - `discover_path` string, nullable — The URL path for the discover view of the app, such as '/discover'. - `experience_path` string, nullable — The URL path for the member-facing hub view of the app, such as '/experiences/[experienceId]'. - `icon` object, nullable — The icon image for the app, used in listings and navigation. - `id` string, required — The ID of an existing file object. - `name` string, nullable — The display name for the app, shown to users on the app store and product pages. - `oauth_client_type` 'public' | 'confidential' — How this app authenticates at the OAuth token endpoint. - `openapi_path` string, nullable — The URL path to the OpenAPI spec file of the app, such as '/assets/openapi.json'. - `redirect_uris` string[], nullable — The whitelisted OAuth callback URLs that users are redirected to after authorizing the app - `required_scopes` AppValidScopes[], nullable — The permission scopes the app will request from users when they install it. - `route` string, nullable — The unique subdomain route where the app's hosted web builds are served, such as 'myapp' for myapp.whop.app. - `secrets` object, nullable — Secrets to add or overwrite on the app, as an object of string values (e.g. {"MAIL_API_KEY": "..."}). Keys not included are left untouched. Pass null or an empty string as the value to delete a secret. Secrets are encrypted at rest and injected into the app's hosted server runtime as environment bindings. - `skills_path` string, nullable — The URL path to the skills directory of the app, such as '/assets/skills/'. - `status` 'live' | 'unlisted' | 'hidden' — The status of an experience interface ## Response `200` A successful response - App — An app is an integration built on Whop. Apps can serve consumers as experiences within products, or serve companies as business tools. - `api_key` object, nullable, required — The API key used to authenticate requests on behalf of this app. Null if no API key has been generated. Requires the 'developer:manage_api_key' permission. - `created_at` string, date-time, required — The datetime the private api key was created. - `id` string, required — The unique identifier for the private api key. - `token` string, required — This is the API key used to authenticate requests - `app_type` 'b2b_app' | 'b2c_app' | 'company_app' | 'component', required — The type of end-user an app is built for - `base_url` string, nullable, required — The production base URL where the app is hosted. Null if no base URL is configured. - `company` object, required — The company that owns and publishes this app. - `id` string, required — The unique identifier for the company. - `title` string, required — The display name of the company shown to customers. - `creator` object, required — The user who created and owns the company that published this app. - `id` string, required — The unique identifier for the user. - `name` string, nullable, required — The user's display name shown on their public profile. - `username` string, required — The user's unique username shown on their public profile. - `dashboard_path` string, nullable, required — The URL path template for a specific view of this app, appended to the base domain (e.g., '/experiences/[experienceId]'). Null if the specified view type is not configured. - `description` string, nullable, required — A written description of what this app does, displayed on the app store listing page. Null if no description has been set. - `discover_path` string, nullable, required — The URL path template for a specific view of this app, appended to the base domain (e.g., '/experiences/[experienceId]'). Null if the specified view type is not configured. - `domain_id` string, required — The unique subdomain identifier for this app's proxied URL on the Whop platform. Forms the URL pattern https://{domain_id}.apps.whop.com. - `experience_path` string, nullable, required — The URL path template for a specific view of this app, appended to the base domain (e.g., '/experiences/[experienceId]'). Null if the specified view type is not configured. - `hosted_url` string, nullable, required — The full canonical URL where this app's hosted web build is served. Null if the app has not claimed a route. - `icon` object, nullable, required — The icon image for this app, displayed on the app store, product pages, checkout, and as the default icon for experiences using this app. - `url` string, nullable, required — A pre-optimized URL for rendering this attachment on the client. This should be used for displaying attachments in apps. - `id` string, required — The unique identifier for the app. - `name` string, required — The display name of this app shown on the app store and in experience navigation. Maximum 30 characters. - `openapi_path` string, nullable, required — The URL path template for a specific view of this app, appended to the base domain (e.g., '/experiences/[experienceId]'). Null if the specified view type is not configured. - `origin` string, nullable, required — The full origin URL for this app's proxied domain (e.g., 'https://myapp.apps.whop.com'). Null if no proxy domain is configured. - `production_web_build` object, nullable, required — The approved app build currently served to users on web. Null if no production build is deployed for web. - `checksum` string, required — A SHA-256 hash of the uploaded build file, generated by the client and used to verify file integrity. - `file_url` string, required — A URL to download the app build as a .zip archive. - `id` string, required — The unique identifier for the app build. - `status` 'draft' | 'pending' | 'approved' | 'rejected', required — The different statuses an AppBuild can be in. - `redirect_uris` string[], required — The whitelisted OAuth callback URLs that users are redirected to after authorizing the app. - `requested_permissions` object[], required — The list of permissions this app requests when installed, including both required and optional permissions with justifications. - `is_required` boolean, required — Whether the action is required for the app to function. - `justification` string, required — The reason for requesting the action. - `permission_action` object, required — The action that the app will request off of users when a user installs the app. - `action` string, required — The identifier of the action. - `name` string, required — The human readable name of the action. - `route` string, nullable, required — The unique subdomain route where this app's hosted web builds are served, such as 'myapp' for myapp.whop.app. Null if the app has not claimed a route. - `secrets` object, nullable, required — The app's secrets as an object of string values. Encrypted at rest and injected into the app's hosted server runtime as environment bindings. Requires the 'developer:update_app' permission. - `skills_path` string, nullable, required — The URL path template for a specific view of this app, appended to the base domain (e.g., '/experiences/[experienceId]'). Null if the specified view type is not configured. - `stats` object, nullable, required — Aggregate usage statistics for this app, including daily, weekly, and monthly active user counts. - `dau` integer, required — The number of unique users who have spent time in this app in the last 24 hours. Returns 0 if no usage data is available. - `mau` integer, required — The number of unique users who have spent time in this app in the last 28 days. Returns 0 if no usage data is available. - `time_spent_last24_hours` integer, required — The total time, in seconds, that all users have spent in this app over the last 24 hours. Returns 0 if no usage data is available. - `wau` integer, required — The number of unique users who have spent time in this app in the last 7 days. Returns 0 if no usage data is available. - `status` 'live' | 'unlisted' | 'hidden', required — The status of an experience interface - `verified` boolean, required — Whether this app has been verified by Whop. Verified apps are endorsed by Whop and displayed in the featured apps section of the app store. ## Other responses - `400` — Bad request - `401` — Unauthorized - `403` — Forbidden - `404` — Not found - `422` — Verification required - `429` — Too many requests - `500` — Internal server error --- [API](https://skmtc.dev/whop/apis/whop-api.md) · [All operations](https://skmtc.dev/whop/apis/whop-api/llms.txt) · [OpenAPI document](https://skmtc-service-production.skmtc.workers.dev/v1/apis/whop/whop-api/revisions/3a06a605784b/schema)