> ## Documentation Index > Fetch the complete documentation index at: https://docs.whop.com/llms.txt > Use this file to discover all available pages before exploring further. # Update app > Update the settings, metadata, or status of an existing app on the Whop developer platform. Required permissions: - `developer:update_app` - `developer:manage_api_key` - `developer:basic:read` ## OpenAPI ````yaml /openapi/api-v1-stable.json patch /apps/{id} openapi: 3.1.0 info: description: >- The Whop REST API. Please see https://docs.whop.com/developer/api/getting-started for more details. termsOfService: https://whop.com/tos-developer-api/ title: Whop API version: 1.0.0 x-api-version-date: '2026-08-21' servers: - description: Production Whop API url: https://api.whop.com/api/v1 - description: Sandbox Whop API url: https://sandbox-api.whop.com/api/v1 security: [] tags: - description: Products name: Products - description: Payments name: Payments - description: Refunds name: Refunds - description: Disputes name: Disputes - description: Dispute alerts name: Dispute alerts - description: Resolution center cases name: Resolution center cases - description: Checkout configurations name: Checkout configurations - description: Setup intents name: Setup intents - description: Payment methods name: Payment methods - description: Invoices name: Invoices - description: Promo codes name: Promo codes - description: Card transactions name: Card transactions - description: Ledger accounts name: Ledger accounts - description: Withdrawals name: Withdrawals - description: Payout methods name: Payout methods - description: Verifications name: Verifications - description: Identity profiles name: Identity profiles - description: Payout accounts name: Payout accounts - description: Topups name: Topups - description: Companies name: Companies - description: Authorized users name: Authorized users - description: Fee markups name: Fee markups - description: Members name: Members - description: Memberships name: Memberships - description: Leads name: Leads - description: Entries name: Entries - description: Shipments name: Shipments - description: Reviews name: Reviews - description: Company token transactions name: Company token transactions - description: Affiliates name: Affiliates - description: Experiences name: Experiences - description: Forums name: Forums - description: Forum posts name: Forum posts - description: Chat channels name: Chat channels - description: Support channels name: Support channels - description: Messages name: Messages - description: Reactions name: Reactions - description: Dm members name: Dm members - description: Dm channels name: Dm channels - description: Notifications name: Notifications - description: Courses name: Courses - description: Course chapters name: Course chapters - description: Course lessons name: Course lessons - description: Course students name: Course students - description: Course lesson interactions name: Course lesson interactions - description: Apps name: Apps - description: Webhooks name: Webhooks - description: App builds name: App builds - description: Access tokens name: Access tokens - description: Account links name: Account links - description: Files name: Files - description: Ai chats name: Ai chats - description: Bounties name: Bounties - description: Stats name: Stats - description: Conversions name: Conversions - description: Ad reports name: Ad reports paths: /apps/{id}: patch: tags: - Apps summary: Update app description: >- Update the settings, metadata, or status of an existing app on the Whop developer platform. Required permissions: - `developer:update_app` - `developer:manage_api_key` - `developer:basic:read` operationId: updateApp parameters: - description: The unique identifier of the app to update, starting with 'app_'. in: path name: id required: true schema: example: app_xxxxxxxxxxxxxx type: string requestBody: content: application/json: schema: description: Parameters for UpdateApp properties: app_store_description: description: >- The detailed description shown on the app store's in-depth app view page. type: - string - 'null' app_type: description: >- The type of end-user the app is built for, such as consumer or business. oneOf: - $ref: '#/components/schemas/AppTypes' - type: 'null' base_url: description: >- The base production URL where the app is hosted. Pass null to take the app proxy offline. example: https://example.com/path type: - string - 'null' dashboard_path: description: >- The URL path for the company dashboard view of the app, such as '/dashboard'. type: - string - 'null' description: description: >- A short description of the app shown in listings and search results. type: - string - 'null' discover_path: description: >- The URL path for the discover view of the app, such as '/discover'. type: - string - 'null' experience_path: description: >- The URL path for the member-facing hub view of the app, such as '/experiences/[experienceId]'. type: - string - 'null' icon: description: The icon image for the app, used in listings and navigation. properties: id: description: The ID of an existing file object. type: string required: - id title: FileInputWithId type: - object - 'null' name: description: >- The display name for the app, shown to users on the app store and product pages. type: - string - 'null' oauth_client_type: description: How this app authenticates at the OAuth token endpoint. oneOf: - $ref: '#/components/schemas/AppOauthClientTypes' - type: 'null' openapi_path: description: >- The URL path to the OpenAPI spec file of the app, such as '/assets/openapi.json'. type: - string - 'null' redirect_uris: description: >- The whitelisted OAuth callback URLs that users are redirected to after authorizing the app items: description: >- Represents textual data as UTF-8 character sequences. This type is most often used by GraphQL to represent free-form human-readable text. type: string type: - array - 'null' required_scopes: description: >- The permission scopes the app will request from users when they install it. items: $ref: '#/components/schemas/AppValidScopes' type: - array - 'null' route: description: >- The unique subdomain route where the app's hosted web builds are served, such as 'myapp' for myapp.whop.app. type: - string - 'null' secrets: additionalProperties: true description: >- Secrets to add or overwrite on the app, as an object of string values (e.g. {"MAIL_API_KEY": "..."}). Keys not included are left untouched. Pass null or an empty string as the value to delete a secret. Secrets are encrypted at rest and injected into the app's hosted server runtime as environment bindings. type: - object - 'null' skills_path: description: >- The URL path to the skills directory of the app, such as '/assets/skills/'. type: - string - 'null' status: description: >- Controls the app's visibility. Set to 'live' to publish on Whop discovery (requires name, icon, and description). Set to 'unlisted' to hide from discovery while keeping the app accessible via direct link. oneOf: - $ref: '#/components/schemas/AppStatuses' - type: 'null' required: [] type: object required: false responses: '200': content: application/json: schema: $ref: '#/components/schemas/App' description: A successful response '400': content: application/json: example: error: code: parameter_missing message: 'Missing required parameter: amount.' param: amount type: invalid_request_error schema: properties: error: properties: code: description: >- A short string indicating the specific error code, e.g. 'parameter_missing', 'parameter_invalid', 'invalid_json' type: - string - 'null' message: type: string param: description: The parameter that caused the error, if applicable type: - string - 'null' type: type: string required: - type - message type: object required: - error type: object description: Bad request '401': content: application/json: example: error: message: Invalid or missing API key type: unauthorized schema: properties: error: properties: code: description: >- A short string indicating the specific error code, e.g. 'parameter_missing', 'parameter_invalid', 'invalid_json' type: - string - 'null' message: type: string param: description: The parameter that caused the error, if applicable type: - string - 'null' type: type: string required: - type - message type: object required: - error type: object description: Unauthorized '403': content: application/json: example: error: message: You do not have permission to access this resource type: forbidden schema: properties: error: properties: code: description: >- A short string indicating the specific error code, e.g. 'parameter_missing', 'parameter_invalid', 'invalid_json' type: - string - 'null' message: type: string param: description: The parameter that caused the error, if applicable type: - string - 'null' type: type: string required: - type - message type: object required: - error type: object description: Forbidden '404': content: application/json: example: error: message: Resource not found type: not_found schema: properties: error: properties: code: description: >- A short string indicating the specific error code, e.g. 'parameter_missing', 'parameter_invalid', 'invalid_json' type: - string - 'null' message: type: string param: description: The parameter that caused the error, if applicable type: - string - 'null' type: type: string required: - type - message type: object required: - error type: object description: Not found '422': content: application/json: example: error: null schema: properties: error: properties: code: description: >- A short string indicating the specific error code, e.g. 'parameter_missing', 'parameter_invalid', 'invalid_json' type: - string - 'null' message: type: string param: description: The parameter that caused the error, if applicable type: - string - 'null' type: type: string required: - type - message type: object required: - error type: object description: Verification required '429': content: application/json: example: error: null schema: properties: error: properties: code: description: >- A short string indicating the specific error code, e.g. 'parameter_missing', 'parameter_invalid', 'invalid_json' type: - string - 'null' message: type: string param: description: The parameter that caused the error, if applicable type: - string - 'null' type: type: string required: - type - message type: object required: - error type: object description: Too many requests '500': content: application/json: example: error: message: An unexpected error occurred type: internal_server_error schema: properties: error: properties: code: description: >- A short string indicating the specific error code, e.g. 'parameter_missing', 'parameter_invalid', 'invalid_json' type: - string - 'null' message: type: string param: description: The parameter that caused the error, if applicable type: - string - 'null' type: type: string required: - type - message type: object required: - error type: object description: Internal server error security: - bearerAuth: - developer:update_app - developer:manage_api_key - developer:basic:read x-codeSamples: - lang: JavaScript source: |- import Whop from '@whop/sdk'; const client = new Whop({ apiKey: process.env['WHOP_API_KEY'], // This is the default and can be omitted }); const app = await client.apps.update('id'); console.log(app.id); components: schemas: AppTypes: description: The type of end-user an app is built for enum: - b2b_app - b2c_app - company_app - component - website type: string AppOauthClientTypes: description: How this app authenticates at the OAuth token endpoint. enum: - public - confidential type: string AppValidScopes: const: read_user description: These are the scopes an app can request on behalf of a user type: string AppStatuses: description: The status of an experience interface enum: - live - unlisted - hidden type: string App: description: >- An app is an integration built on Whop. Apps can serve consumers as experiences within products, or serve companies as business tools. properties: api_key: description: >- The API key used to authenticate requests on behalf of this app. Null if no API key has been generated. Requires the 'developer:manage_api_key' permission. properties: created_at: description: The datetime the private api key was created. example: '2023-12-01T05:00:00.401Z' format: date-time type: string id: description: The unique identifier for the private api key. type: string token: description: This is the API key used to authenticate requests type: string required: - id - token - created_at type: - object - 'null' app_type: $ref: '#/components/schemas/AppTypes' description: >- The target audience classification for this app (e.g., 'b2b_app', 'b2c_app', 'company_app', 'component'). base_url: description: >- The production base URL where the app is hosted. `null` if no base URL is configured, or if the caller lacks the `developer:basic:read` permission on the app's account. example: https://myapp.example.com type: - string - 'null' company: description: The company that owns and publishes this app. properties: id: description: The unique identifier for the company. example: biz_xxxxxxxxxxxxxx type: string title: description: The display name of the company shown to customers. example: Pickaxe type: string required: - id - title type: object creator: description: The user who created and owns the company that published this app. properties: id: description: The unique identifier for the user. example: user_xxxxxxxxxxxxx type: string name: description: The user's display name shown on their public profile. example: John Doe type: - string - 'null' username: description: The user's unique username shown on their public profile. example: johndoe42 type: string required: - id - name - username type: object dashboard_path: description: >- The URL path template for a specific view of this app, appended to the base domain (e.g., '/experiences/[experienceId]'). Null if the specified view type is not configured. example: /experiences/[experienceId] type: - string - 'null' default_api_key: description: >- The app's default API key, used to authenticate requests on behalf of this app. Null if the app has no default key. Requires the 'developer:manage_api_key' permission. properties: id: description: The unique identifier for the authorized api key. type: string name: description: A user set name to identify an API key type: - string - 'null' obfuscated_secret_key: description: >- A masked version of the secret key used to authenticate requests. This is so that the owner can easily identify which key it is without being shown the full secret. type: string secret_key: description: >- The secret key used to authenticate requests. This is only available if the current actor would have been able to create this api key. type: - string - 'null' required: - id - name - obfuscated_secret_key - secret_key type: - object - 'null' description: description: >- A written description of what this app does, displayed on the app store listing page. Null if no description has been set. example: >- A comprehensive analytics dashboard for tracking revenue, members, and growth metrics. type: - string - 'null' discover_path: description: >- The URL path template for a specific view of this app, appended to the base domain (e.g., '/experiences/[experienceId]'). Null if the specified view type is not configured. example: /experiences/[experienceId] type: - string - 'null' domain_id: description: >- The unique subdomain identifier for this app's proxied URL on the Whop platform. Forms the URL pattern https://{domain_id}.apps.whop.com. example: ab1c2d3e4f5g6h7i8j9k type: string experience_path: description: >- The URL path template for a specific view of this app, appended to the base domain (e.g., '/experiences/[experienceId]'). Null if the specified view type is not configured. example: /experiences/[experienceId] type: - string - 'null' hosted_url: description: >- The full canonical URL where this app's hosted web build is served. Null if the app has not claimed a route. example: https://myapp.whop.app type: - string - 'null' icon: description: >- The icon image for this app, displayed on the app store, product pages, checkout, and as the default icon for experiences using this app. properties: url: description: >- A pre-optimized URL for rendering this attachment on the client. This should be used for displaying attachments in apps. example: https://media.whop.com/abc123/optimized.jpg type: - string - 'null' required: - url type: - object - 'null' id: description: The unique identifier for the app. example: app_xxxxxxxxxxxxxx type: string marketplace_status: description: >- The approval status of this app's product listing on the Whop app store. Null if the app has no associated product. oneOf: - $ref: '#/components/schemas/MarketplaceStatuses' - type: 'null' name: description: >- The display name of this app shown on the app store and in experience navigation. Maximum 30 characters. example: Courses type: string oauth_client_type: $ref: '#/components/schemas/AppOauthClientTypes' description: >- How this app authenticates when exchanging OAuth authorization and refresh grants. openapi_path: description: >- The URL path template for a specific view of this app, appended to the base domain (e.g., '/experiences/[experienceId]'). Null if the specified view type is not configured. example: /experiences/[experienceId] type: - string - 'null' origin: description: >- The full origin URL for this app's proxied domain (e.g., 'https://myapp.apps.whop.com'). Null if no proxy domain is configured. type: - string - 'null' product_id: description: >- Represents a unique identifier that is Base64 obfuscated. It is often used to refetch an object or as key for a cache. The ID type appears in a JSON response as a String; however, it is not intended to be human-readable. When expected as an input type, any string (such as `"VXNlci0xMA=="`) or integer (such as `4`) input value will be accepted as an ID. type: - string - 'null' production_web_build: description: >- The approved app build currently served to users on web. Null if no production build is deployed for web. properties: checksum: description: >- A SHA-256 hash of the uploaded build file, generated by the client and used to verify file integrity. example: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 type: string file_url: description: A URL to download the app build as a .zip archive. example: https://cdn.whop.com/builds/abc123.zip type: string id: description: The unique identifier for the app build. example: apbu_xxxxxxxxxxxxx type: string source_url: description: >- A URL to download the compressed source code archive that produced this build. Null if the build was uploaded without a source archive. example: https://cdn.whop.com/builds/abc123-source.zip type: - string - 'null' status: $ref: '#/components/schemas/AppBuildStatuses' description: The current review status of this build. required: - id - file_url - source_url - checksum - status type: - object - 'null' redirect_uris: description: >- The whitelisted OAuth callback URLs that users are redirected to after authorizing the app. items: description: >- Represents textual data as UTF-8 character sequences. This type is most often used by GraphQL to represent free-form human-readable text. type: string type: array requested_permissions: description: >- The list of permissions this app requests when installed, including both required and optional permissions with justifications. items: description: >- A permission that the app requests from the admin of a company during the oauth flow. properties: is_required: description: Whether the action is required for the app to function. type: boolean justification: description: The reason for requesting the action. type: string permission_action: description: >- The action that the app will request off of users when a user installs the app. properties: action: description: The identifier of the action. type: string name: description: The human readable name of the action. type: string required: - action - name type: object required: - permission_action - is_required - justification type: object type: array route: description: >- The unique subdomain route where this app's hosted web builds are served, such as 'myapp' for myapp.whop.app. Null if the app has not claimed a route. example: myapp type: - string - 'null' secrets: additionalProperties: true description: >- The app's secrets as an object of string values. Encrypted at rest and injected into the app's hosted server runtime as environment bindings. Requires the 'developer:update_app' permission. type: - object - 'null' skills_path: description: >- The URL path template for a specific view of this app, appended to the base domain (e.g., '/experiences/[experienceId]'). Null if the specified view type is not configured. example: /experiences/[experienceId] type: - string - 'null' stats: description: >- Aggregate usage statistics for this app, including daily, weekly, and monthly active user counts. properties: dau: description: >- The number of unique users who have spent time in this app in the last 24 hours. Returns 0 if no usage data is available. example: 42 type: integer mau: description: >- The number of unique users who have spent time in this app in the last 28 days. Returns 0 if no usage data is available. example: 42 type: integer time_spent_last24_hours: description: >- The total time, in seconds, that all users have spent in this app over the last 24 hours. Returns 0 if no usage data is available. example: 42 type: integer wau: description: >- The number of unique users who have spent time in this app in the last 7 days. Returns 0 if no usage data is available. example: 42 type: integer required: - dau - mau - time_spent_last24_hours - wau type: - object - 'null' status: $ref: '#/components/schemas/AppStatuses' description: >- The current visibility status of this app on the Whop app store. 'live' means publicly discoverable, 'unlisted' means accessible only via direct link, and 'hidden' means not visible anywhere. verified: description: >- Whether this app has been verified by Whop. Verified apps are endorsed by Whop and displayed in the featured apps section of the app store. type: boolean required: - id - name - description - status - domain_id - route - hosted_url - verified - app_type - origin - experience_path - discover_path - dashboard_path - skills_path - openapi_path - company - icon - creator - requested_permissions - stats - api_key - default_api_key - production_web_build - base_url - redirect_uris - secrets - product_id - marketplace_status - oauth_client_type type: object MarketplaceStatuses: description: The available marketplace statuses to choose from. enum: - not_available - pending_review - live_marketplace type: string AppBuildStatuses: description: The different statuses an AppBuild can be in. enum: - draft - pending - approved - rejected type: string securitySchemes: bearerAuth: bearerFormat: auth-scheme description: >- An Account API key, account-scoped JWT, App API key, or user OAuth token. Prepend the key or token with `Bearer`, for example `Bearer ***************************`. scheme: bearer type: http ````