> ## Documentation Index > Fetch the complete documentation index at: https://docs.whop.com/llms.txt > Use this file to discover all available pages before exploring further. # Update App > Updates the settings, metadata, or status of an app. Fields that are omitted keep their current value. ## OpenAPI ````yaml /openapi/api-v1-native.json patch /apps/{id} openapi: 3.1.0 info: description: >- The Whop REST API. Please see https://docs.whop.com/developer/api/getting-started for more details. termsOfService: https://whop.com/tos-developer-api/ title: Whop API version: 1.0.0 x-api-version-date: '2026-08-21' servers: - description: Production Whop API url: https://api.whop.com/api/v1 - description: Sandbox Whop API url: https://sandbox-api.whop.com/api/v1 security: [] tags: - description: > An Account represents a person or business on Whop that can have its own profile, wallet, and account-scoped settings. Use accounts for customers, creators, merchants, sellers, or connected businesses your integration supports. Use the Accounts API to create accounts, list accounts visible to your credentials, retrieve or update an account, and retrieve the account associated with the current API key. name: Accounts x-whop-summary: 'A business on Whop: profile, wallet, capabilities, settings.' - description: > A User represents a person on Whop. Users have a public profile and can buy products, join accounts, and access experiences. Use the Users API to search for users, retrieve or update profiles, and check whether a user has access to an account, product, or experience. name: Users x-whop-summary: 'A person on Whop: profile and connected identities.' - description: > A Team Member is a member of an account's team: the link between a user and an account, carrying the role that controls what they can do. Roles are either system roles (like `admin` or `moderator`) or `custom` roles managed from the dashboard. Use the Team Members API to list an account's team, add a user to the team with a system role, change a member's role, and remove members. Adding a user who has not yet accepted sends an invitation instead. name: Team Members x-whop-summary: An account's team members and the roles that scope their access. - description: > A Member is one buyer's relationship with an account — one record per customer regardless of how many memberships they hold. It carries relationship-level state: whether they have joined or left, their access level (`customer`, `admin`, or `no_access`), when they joined, and when they last opened the account's content. Use the Members API to list an account's members with filtering by access level, status, join date, and name or username search, and to retrieve a single member. Member rows are created and maintained by the membership lifecycle; to grant or revoke access, work with memberships instead. name: Members x-whop-summary: One buyer's relationship with an account, across all their purchases. - name: Webhooks x-whop-summary: Event notifications pushed to your server as things happen. - description: > Stats represent aggregated activity for an account over time. They help you understand revenue, transactions, disputes, members, referrals, and advertising performance across reporting periods like days, weeks, or months. Use the Stats API to list available metrics and their filterable properties, then retrieve time-series values for a date range. name: Stats x-whop-summary: Aggregated financial, audience, and traffic reporting. - description: > A Verification represents a legal identity for a person or business. Accounts and users complete verification when Whop needs to confirm who they are before enabling payouts or compliance-sensitive workflows. Use the Verifications API to start or resume a hosted verification session, check review status, and submit requested details or documents. If `requested_information` contains items, submit answers with [Update Verification](/api-reference/beta/verifications/update-verification). name: Verifications x-whop-summary: Legal identity required before payouts and card issuing. - description: > An Export is an asynchronous CSV of one resource for one account — members, payments, disputes, ads, and the other tables the Whop dashboard can export. Generating a full table takes longer than a request, so an export is created in `pending`, moves through `processing`, and lands on `completed` with a download link. Each resource requires that resource's own export scope. Use the Exports API to start an export, poll it until `download_url` is set, and list the exports already requested for an account. Finished CSVs are retained for 30 days, after which the file is deleted and the export moves to `expired`. name: Exports x-whop-summary: Asynchronous CSV dumps of an account's dashboard data. - description: > A Notification is a message delivered to a user — a new post, a payment, a mention. Every notification comes from an experience the user belongs to or a team they are on, and users control what they receive with notification preferences. Every notification belongs to a topic: the category it falls under, such as new sales or account activity. Topics carry a default, so a user only needs a preference row where they diverge from it. `GET /notifications/topics` lists the platform's visible topics, and a topic's `id` is what the notification preference endpoints take as `topic_id` — the catalog is the only place those ids come from, so read it rather than hardcoding. Each topic also carries an `identifier` such as `new-follower`, which is stable across environments and is the value to match on in code. Use the Notifications API to list the authenticated user's feed, read per-experience unread badges, mark an experience (or everything) as read, send notifications from your app to an experience's users or an account's team, and list the topic catalog. name: Notifications x-whop-summary: >- The user's notification feed: unread badges, mark-read, app sends, and the topic catalog. - description: > A Payment is one charge against a buyer. Create it with a payment method already on file, or with a `confirmation_token` describing a method the buyer has just supplied. Collection runs in the background, so the create response is not the outcome. Poll [Retrieve status](/api-reference/beta/payments/retrieve-status) for how far the payment has got and, while it is `requires_action`, what the buyer must do next — follow a redirect, complete 3D Secure, display transfer instructions, or link a bank account. Use the return_url operation to change where they land afterwards, up until they come back. name: Payments x-whop-summary: A charge against a buyer, and the step they still owe. - description: > A Setup Intent saves a buyer's payment method for later without taking money now. It runs the same collection flow a payment does, so the buyer may still owe a step — 3D Secure on a card, a hosted enrollment, or linking a bank account. Poll [Retrieve status](/api-reference/beta/setup-intents/retrieve-status) for how far the setup has got and what is outstanding. Once it reaches `succeeded` the method is on file and can be charged. name: Setup Intents x-whop-summary: Saving a buyer's payment method without charging it. - description: > A Ledger Activity row is a single financial event on an account's ledger — a payment, withdrawal, refund, transfer, on-chain deposit, swap, or card transaction. Each row is derived from the underlying ledger lines and carries a typed `resource` and `source` so you can present and link the event without extra lookups. Use Ledger Activity to build a statement or transaction feed for an account or user. Reconcile against your own records with `amount` (signed, in the currency's smallest precision units) and `posted_at`, and use `available_at` to know when inflows became withdrawable. name: Ledgers x-whop-summary: The activity feed behind an account or user's balance. - description: > Payouts represent money sent from an account or user balance to an external destination, such as a bank account, wallet, or other saved payout method. Use the Payouts API to create and track payouts, manage saved payout methods, and show expected arrival details for funds leaving Whop. name: Payouts x-whop-summary: Send money from a balance to a bank or wallet. - description: > Cards represent Whop-issued virtual payment cards that spend from an account or user balance. Cards can be assigned to cardholders and configured with spending limits for controlled spending. Use the Cards API to issue cards, list cards for an account or user, and retrieve active card details such as the card number and CVC. name: Cards x-whop-summary: Issue cards that spend from a balance. - description: > Transfers move value between identities on Whop. They are used for account-to-account money movement, user payouts inside Whop, crypto transfers, and claim links depending on the destination type. Use the Transfers API to create a transfer, list previous transfers, and retrieve a transfer by ID when reconciling money movement between accounts or users. name: Transfers x-whop-summary: Move funds between Whop accounts and users. - description: > A Dispute is a chargeback a customer files against a payment through their bank, or an inquiry that may become one. It carries the disputed payment, a deadline to respond, your evidence, and the outcome once the processor rules. Use the Disputes API to list disputes, edit the evidence packet while a dispute is still contestable, and submit it for review. name: Disputes x-whop-summary: Chargebacks filed against an account, with evidence and outcomes. - description: > A Dispute alert is an early warning from a card issuer that a settled payment is being questioned, ahead of any chargeback. `type` separates fraud reports (`early_fraud_warning`), pre-dispute notices (`dispute_alert`), and Visa RDR cases the network already closed by refunding (`rapid_dispute_resolution`). Use the Dispute alerts API to list alerts for an account, filter them by type or payment, and read `actionable` to see whether refunding can still avoid the chargeback. name: Dispute alerts x-whop-summary: Issuer warnings that arrive before a chargeback does. - description: > Deposits describe ways to add funds to an account balance, including hosted deposit pages, bank deposit instructions, and supported crypto wallet addresses. Use the Deposits API to create deposit instructions for an account. name: Deposits x-whop-summary: Add funds to a balance. - description: > Swaps convert value between supported tokens, chains, or wallet destinations for an account. A swap quote describes the expected output, fees, and approval requirements before you create the swap. Use the Swaps API to quote a conversion, create the swap, list recent swaps, and retrieve status until the transaction completes. name: Swaps x-whop-summary: Convert a balance between currencies. - description: > A Resolution Center Case is opened by a buyer when something is wrong with a purchase — an unwanted renewal, an item that never arrived, or a charge they don't recognize. It is the step before a chargeback: the two sides work it out directly, and Whop decides the case if they can't. Each case carries a reason, a status naming which side it is waiting on, a timeline of events, and the actions available to whoever is reading it. Use the Resolution Center Cases API from either side: as the buyer, open a case, reply, appeal a decision, or withdraw it; as the merchant, accept it (refunding the payment), deny it, or ask the buyer for more information. Both sides read the same case, page its timeline, and summarize the cases they can see. name: Resolution Center Cases x-whop-summary: File or respond to a case against a payment, as the buyer or the merchant. - description: > A Product is a digital good or service sold on Whop. Products may contain plans for pricing and/or experiences for content delivery. Use the Products API to create products, list products visible to your credentials, retrieve product details, update product metadata or merchandising fields, and delete products that should no longer be sold. name: Products x-whop-summary: The things you sell. Each owns plans and a store page. - description: > A Plan defines how customers buy a product. It controls pricing, billing cadence, availability, tax behavior, checkout fields, and purchase visibility. Use the Plans API to create plans for products, list existing plans, retrieve or update plan configuration, calculate tax for checkout, and delete plans that should no longer be offered. name: Plans x-whop-summary: 'Pricing for a product: one-time, recurring, trials, stock.' - name: Promo Codes x-whop-summary: Discounts that creators configure for checkout. - description: > A Membership is a customer's purchase of a plan: the subscription or one-time grant that gives them access to a product. It tracks billing state (`active`, `trialing`, `past_due`, and so on), the current period, pending cancellations, custom metadata, and the software license key when the product includes licensing. Use the Memberships API to list an account's memberships or the caller's own, retrieve one by ID or license key, invite a recipient to join through a free plan, and manage the lifecycle: cancel immediately or at period end, reverse a scheduled period-end cancellation, pause and resume payment collection, extend with free days, generate a transfer link, and update metadata. name: Memberships x-whop-summary: A customer's purchase of a plan, from checkout through cancellation. - description: > A Checkout Configuration is a reusable checkout link owned by an account. In `payment` mode it sells a specific plan; in `setup` mode it collects and saves payment details without charging. Each configuration can also override which payment methods are accepted and how 3D Secure is enforced for that checkout. Use the Checkout Configurations API to create checkout links for an existing or inline plan, list configurations for an account, retrieve the configuration behind a checkout URL, and delete links that should no longer be used. name: Checkout Configurations x-whop-summary: Turn a plan into a shareable, prefilled checkout link. - description: > A Payment Method Domain registers a hostname with a wallet provider so its payment methods can appear at a checkout served from that domain. The domain proves ownership by hosting the provider's association file — for Apple Pay, at `/.well-known/apple-developer-merchantid-domain-association` — and `status` reports whether verification has completed. Use the Payment Method Domains API to register domains for your account or its connected accounts, retry verification once the association file is hosted, and remove domains that should no longer serve wallet payments. A domain a platform shares with its connected accounts at checkout is listed on the platform's account, not on each connected account. name: Payment Method Domains x-whop-summary: >- Domains verified to show wallet payment methods like Apple Pay at checkout. - description: > A Shipment attaches a carrier tracking number to a payment and follows the package from label creation to delivery, exposing the current delivery status and a customer-facing tracking URL. Use the Shipments API to list an account's shipments, retrieve one by its id or the payment it fulfills, attach a tracking number to a payment, and update the tracking number on an existing shipment. name: Shipments x-whop-summary: Track the delivery of an order by its carrier tracking number. - description: > The Partners API covers your Whop partner activity: the users you referred onto Whop, the businesses you referred and the earnings generated from their processing volume, and the partner leaderboard. Use it to enroll as a Whop partner, list the users you referred, list your referred businesses and review their earnings, and see the partner leaderboard. name: Partners x-whop-summary: >- The users and businesses you referred to Whop, and what you earn from them. - description: > A Bounty is a paid task posted by an account or user. The reward is held in escrow when the bounty publishes, workers submit proof of completed work, and each accepted submission is paid out until every winner slot fills. Use the Bounties API to create and publish a bounty, list an account's bounties for reporting or dashboards, list the bounties a user can work or has participated in, and retrieve a single bounty by ID. name: Bounties x-whop-summary: Paid tasks with reviewed submissions and escrowed rewards. - description: > A Bounty Submission is one worker's attempt on a bounty. It starts as an in-progress attempt, enters the review queue when proof is submitted, and ends approved (paid from the bounty's escrowed pool) or denied. Use the Bounty Submissions API to submit proof of completed work to a bounty, list the submissions you authored, and review the submissions on your bounties — across every bounty or narrowed to one. name: Bounty Submissions x-whop-summary: Work submitted to a bounty, from attempt to payout. - description: > A Person is an identity-linked profile of a visitor or customer of an account, assembled from every [event](/api-reference/beta/events/event) the person generated — pixel page views, ad clicks, leads, identifies, and payments. Each profile carries the person's known identities (names, emails, phones, user IDs), purchase history and LTV, geo/device profile, traffic sources, and the first and last marketing touches that reached them. Use the People API to list and segment the people of an account — filter by activity, purchases, traffic source, location, or marketing touch, and sort by value — or retrieve one person by person ID, user ID, email address, or phone number. name: People x-whop-summary: >- Visitors and customers of an account, with identity, purchase, and traffic profiles. - description: > An Event records conversion or engagement activity for an account, such as page views, purchases, or leads. Each event ties the action to the [person](/api-reference/beta/people/person) who took it, so activity can be attributed to the ads and links that drove it. Use the Events API to send new tracking events, list recent identity-linked events for an account, and inspect the events recorded for a person. The resource also exposes an anonymized read mode — the pulse feed — a platform-wide snapshot of recent purchases that carries nothing identifying. The pulse feed is public; other Events endpoints require authentication and are scoped to an account. Events are only as good as the pixel sending them, so [Validate Pixel](/api-reference/beta/events/validate-pixel) answers whether an account's pixel is working: it reads the events the pixel has sent, and when you pass a `url` whose page hasn't sent any lately, it fetches that page and looks for the pixel in its source. Use it before launching an ad to confirm its destination is tracked, or in a setup flow to tell a merchant whether their install is live. name: Events x-whop-summary: Conversion and engagement events tracked for attribution. - description: > A Recommended Action Chain is a short, ordered sequence of dashboard actions — create a product, price it, publish it — suggested for an account based on what it already has. Seeded chains come from hand-written presets; generated chains, produced per account, share the same shape. Use the Recommended Actions API to list the chains recommended for an account and to record that a chain was run. Running a chain executes nothing server-side — the client follows each step's CTA itself; the run endpoint records the `recommended_action_chain.executed` analytics event. name: Recommended Actions x-whop-summary: Suggested next-step action chains for an account. - description: > An Ad is the individual creative unit delivered by an [ad group](/api-reference/beta/ad-groups/ad-group). It holds the copy, creative assets, and destination URL for one ad. Use the Ads API to list ads for an account, create ads inside ad groups, retrieve or update creative details, delete ads that should stop running, and pause or resume delivery. name: Ads x-whop-summary: 'The creative: copy, assets, and destination URL.' - description: > An Ad Campaign is the top-level container for paid ads on an ad network. It sets the platform, objective, and budget strategy shared by its [ad groups](/api-reference/beta/ad-groups/ad-group) and ads. Use the Ad Campaigns API to create campaigns, list campaigns for an account, retrieve or update campaign settings, and pause or resume campaign delivery. name: Ad Campaigns x-whop-summary: Platform, objective, and budget for a set of ads. - description: > An Ad Group sits inside an [ad campaign](/api-reference/beta/ad-campaigns/ad-campaign) and controls delivery for [ads](/api-reference/beta/ads/ad). It sets the audience, placements, schedule, budget, and optimization goal for its ads. Use the Ad Groups API to create ad groups in campaigns, list or retrieve targeting and delivery settings, update budgets or targeting, delete groups that should stop running, and pause or resume delivery. It can also search the ad platform's targeting taxonomy for options to target and estimate how many people a draft targeting spec can reach. name: Ad Groups x-whop-summary: Audience, placements, and schedule within a campaign. - description: > An Audience represents a customer list uploaded to Whop for ad targeting. Audiences belong to an account and sync to supported ad platforms as custom audiences. Use the Audiences API to create audiences from CSV uploads, monitor processing status, and list or delete audiences for an account. Created audiences are usable for targeting after processing reaches `ready` or `partial`. name: Audiences x-whop-summary: Reusable targeting lists for ad groups. - description: > A Media Asset is an AI-generated image or video created from a prompt and billed from an account balance. When generation finishes, the asset includes a file that can be attached anywhere Whop accepts files. Use the Media API to start a generation job and retrieve the asset while it processes or after it is ready. name: Media x-whop-summary: >- AI-generated assets, billed from a balance, attachable wherever files are accepted. - description: > A Social Account represents an external profile connected to a Whop account or user, such as a Facebook page or Instagram account. Connecting a social account lets Whop run [ads](/api-reference/beta/ads/ad) under that profile's identity and promote its existing posts. Use the Social Accounts API to list connected accounts, create a Whop-managed Facebook page, start an OAuth connection, disconnect a social account, and list a connected profile's posts or a Facebook page's lead forms. name: Social Accounts x-whop-summary: Connected Facebook and Instagram accounts that run ads. - description: > An App is software you build on Whop. It can be a hosted web app served at `.whop.app` or an API integration installed as an experience, and it belongs to the account that owns its credentials, settings, builds, and runtime logs. Use the Apps API to manage app configuration, deploy an app's working copy and follow the run on the app's `deployment` field, and, for hosted apps, read server runtime logs for console output, uncaught exceptions, and failed requests. Logs are retained for 7 days and can be filtered by build, level, time window, and message text. name: Apps x-whop-summary: 'Apps you build on Whop: metadata, hosted builds, runtime logs.' - description: > An App Build is a versioned artifact uploaded for an app — a hosted web archive, or an iOS/Android bundle. Builds start as drafts, go through review, and one approved build per platform is served to users as the production build. Use the App Builds API to upload a build for an app, list an app's builds with platform and status filters, retrieve a build, and promote a draft or approved build to production. name: App Builds x-whop-summary: Versioned build artifacts deployed to an app's platforms. - description: > An API Key is a programmatic credential owned by an account or app. Each key carries its own permissions policy — explicit permission statements or an inherited system role — and can be restricted with an expiration date and an IP allowlist. Use the API Keys API to list an account or app's keys, create a key (the full secret is returned once, on creation), inspect a key's effective grants, update its name or restrictions, rotate its secret, and revoke it. These endpoints require a user session — they cannot be called with an API key. name: API Keys x-whop-summary: Programmatic credentials for an account or app. - description: > A Permission is one action, such as `stats:read`, paired with whether your credential is granted it on a given resource. It answers for whatever you authenticated with, so you can decide what to show or attempt instead of discovering a `403`. Use the Permissions API to check an account, product, experience, or app, narrowing to the actions you care about. It reports only your own access — to manage who else can reach an account, use the Team Members API. name: Permissions x-whop-summary: What your credential is allowed to do on a resource. paths: /apps/{id}: parameters: - $ref: '#/components/parameters/ApiVersionDate' - description: >- App ID (prefixed `app_`), the app's claimed route, or its proxy domain id. in: path name: id required: true schema: type: string patch: tags: - Apps summary: Update App description: >- Updates the settings, metadata, or status of an app. Fields that are omitted keep their current value. operationId: updateApp parameters: [] requestBody: content: application/json: schema: properties: app_store_description: description: >- The detailed description shown on the app store's in-depth app view page. example: >- Shine Time Booking turns a whop into a booking calendar. Members pick a package, choose a slot that fits the day's route, and pay up front. type: string app_type: description: >- The type of end-user the app is built for. Cannot be changed on an app whose type is already `website`. enum: - b2b_app - b2c_app - company_app - component - website example: b2c_app type: string base_url: description: >- The base production URL where the app is hosted. Set to `null` to take the app proxy offline. example: https://booking.shinetime.example type: - string - 'null' dashboard_path: description: The URL path for the account dashboard view. example: /dashboard/[companyId] type: - string - 'null' description: description: >- A short description of the app shown in listings and search results. example: >- Let members book a mobile detailing appointment without leaving your whop. type: string discover_path: description: The URL path for the discover view. example: /discover type: - string - 'null' experience_path: description: >- The URL path for the member-facing hub view, such as `/experiences/[experienceId]`. example: /experiences/[experienceId] type: - string - 'null' icon: description: >- The icon image for the app in PNG, JPEG, or GIF format, referencing an uploaded file: `{ id }` for an existing attachment or `{ direct_upload_id }` for a new direct upload. properties: direct_upload_id: description: The signed id of a completed direct upload. example: >- eyJfcmFpbHMiOnsiZGF0YSI6MSwicHVyIjoiYmxvYl9pZCJ9fQ==--xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx type: string id: description: The tag of an already-uploaded attachment. example: file_xxxxxxxxxxxxxx type: string type: object name: description: >- The display name for the app, shown to users on the app store and product pages. example: Shine Time Booking Pro type: string oauth_client_type: description: How the app authenticates at the OAuth token endpoint. enum: - public - confidential example: confidential type: string openapi_path: description: >- The URL path to the app's OpenAPI spec file (requires the ai_chat capability). example: /openapi.json type: - string - 'null' production_android_build_id: description: >- The app build (`abld_` tag) to serve as the Android production build, or `null` to unassign it. Same rules as `production_web_build_id`. example: apbu_xxxxxxxxxxxxxx type: - string - 'null' production_ios_build_id: description: >- The app build (`abld_` tag) to serve as the iOS production build, or `null` to unassign it. Same rules as `production_web_build_id`. example: apbu_xxxxxxxxxxxxxx type: - string - 'null' production_web_build_id: description: >- The app build (`abld_` tag) to serve as the web production build, or `null` to unassign it. The build must belong to this app, target web, and be in the draft or approved status; a draft build is queued for approval and takes over once approved. Requires the `developer:manage_builds` scope. example: apbu_xxxxxxxxxxxxxx type: - string - 'null' redirect_uris: description: >- The whitelisted OAuth callback URLs users are redirected to after authorizing the app. items: example: https://booking.shinetime.example/oauth/callback type: string type: array required_scopes: description: >- The OAuth scopes the app requests from users when they install it. items: example: read_user type: string type: array route: description: >- The subdomain route where the app's hosted web builds are served. example: shine-time-booking-pro type: string secrets: description: >- Secrets to add or overwrite on the app, as an object of string values. Keys not included are left untouched; pass null or an empty string as the value to delete a secret. Encrypted at rest and injected into the app's hosted server runtime. example: BOOKING_CALENDAR_ID: cal_9f21 type: object skills_path: description: >- The URL path to the app's skills directory (requires the ai_chat capability). example: /skills type: - string - 'null' status: description: >- Controls whether the app is published on Whop discovery or accessible only through its direct link. Publishing requires a name, icon, and description. enum: - live - unlisted - hidden example: unlisted type: string type: object required: true responses: '200': content: application/json: schema: $ref: '#/components/schemas/App' description: app updated '400': $ref: '#/components/responses/InvalidParameters' description: the request body is invalid '401': $ref: '#/components/responses/Unauthorized' description: missing or invalid authentication '403': $ref: '#/components/responses/Forbidden' description: credential lacks the app-update scope '404': $ref: '#/components/responses/NotFound' description: no app with that ID exists security: - bearerAuth: - developer:update_app x-codeSamples: - lang: JavaScript source: |- import Whop from '@whop/sdk'; const client = new Whop({ apiKey: process.env['WHOP_API_KEY'], // This is the default and can be omitted }); const app = await client.apps.update('id'); console.log(app.id); components: parameters: ApiVersionDate: description: Pins the request to a dated API version. in: header name: Api-Version-Date required: false schema: example: '2026-08-21' type: string schemas: App: properties: account: $ref: '#/components/schemas/AccountParent' description: The account that owns the app. api_key: description: >- Legacy app API key used to authenticate requests on the app's behalf. `null` when no key exists or the caller lacks the `developer:manage_api_key` permission. oneOf: - $ref: '#/components/schemas/AppApiKey' - type: 'null' app_store_description: description: >- Detailed description shown on the app store's in-depth app page, or `null` when none has been set. example: >- Shine Time Booking turns a whop into a booking calendar. Members pick a package, choose a slot that fits the day's route, and pay up front. A reminder goes out the night before and the receipt lands as soon as the job is signed off. type: - string - 'null' app_type: description: The type of end-user the app is built for. enum: - b2b_app - b2c_app - company_app - component - website example: b2c_app type: string banner_image: description: >- Banner image from the app's product listing, or `null` when none is uploaded. oneOf: - $ref: '#/components/schemas/AppBannerImage' - type: 'null' base_url: description: >- The production base URL where the app is hosted. `null` if no base URL is configured, if the caller lacks the `developer:basic:read` permission on the app's account, or on list responses, which never expose it. example: https://booking.shinetime.example type: - string - 'null' businesses_created_count: description: Website businesses created from this app as a template. example: 5 type: integer businesses_created_logo_urls: items: description: >- Up to three logo image URLs from businesses created from this app as a template. example: >- https://whop-assets-example.s3.amazonaws.com/uploads/image/2026-01-01/xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx type: string type: array creator: $ref: '#/components/schemas/AppCreator' description: The user who owns the publishing account. dashboard_path: description: >- URL path for the account dashboard view, or `null` when not configured. example: /dashboard/[companyId] type: - string - 'null' default_api_key: description: >- The app's default API key. `null` when the app has no default key or the caller lacks the `developer:manage_api_key` permission; `secret_key` is additionally `null` unless the caller could have created the key themselves. oneOf: - $ref: '#/components/schemas/AppDefaultApiKey' - type: 'null' deployment: description: >- What the app has left to publish, and how a publish in flight is going — `status` is only ever `unpublished`, `publishing`, or `failed` here. `null` means there is nothing to report: the app is fully published, there is no working copy to publish from, or the caller cannot deploy this app. Tell those apart from the app's own `production_web_build`. oneOf: - $ref: '#/components/schemas/AppDeployment' - type: 'null' description: description: >- Short description shown in listings and search results, or `null` if none has been set. example: >- Let members book a mobile detailing appointment without leaving your whop. type: - string - 'null' discover_path: description: URL path for the discover view, or `null` when not configured. example: /discover type: - string - 'null' domain_id: description: >- Subdomain identifier for the app's proxied URL, forming https://{domain_id}.apps.whop.com. example: whopappdomain0000001 type: string experience_path: description: >- URL path for the member-facing hub view, or `null` when not configured. example: /experiences/[experienceId] type: - string - 'null' hosted_url: description: >- Full URL where the app's hosted web build is served, or `null` if no route is claimed. example: https://shine-time-booking.whop.app type: - string - 'null' icon: $ref: '#/components/schemas/AppIcon' description: >- The app's icon. Falls back to the default app icon when none is uploaded. id: description: App ID, prefixed `app_`. example: app_xxxxxxxxxxxxxx type: string marketplace_status: description: >- Approval status of the app's product listing on the Whop app store, or `null` when the app has no associated product. enum: - not_available - pending_review - live_marketplace - null example: not_available type: - string - 'null' name: description: Display name shown on the app store and in experience navigation. example: Shine Time Booking type: string oauth_client_type: description: How the app authenticates at the OAuth token endpoint. enum: - public - confidential example: public type: string openapi_path: description: >- URL path to the app's OpenAPI spec file, or `null` when not configured. example: /openapi.json type: - string - 'null' origin: description: >- Full origin URL of the app's proxied domain, for example https://ab1c2d3e4f.apps.whop.com. example: https://whopappdomain0000001.apps.whop.com type: - string - 'null' product_id: description: >- ID of the app's product listing on the Whop app store, or `null` when the app has no associated product. example: prod_xxxxxxxxxxxxxx type: - string - 'null' production_android_build: description: >- The approved build currently served on Android, or `null` when none is deployed. oneOf: - $ref: '#/components/schemas/AppProductionBuild' - type: 'null' production_ios_build: description: >- The approved build currently served on iOS, or `null` when none is deployed. oneOf: - $ref: '#/components/schemas/AppProductionBuild' - type: 'null' production_web_build: description: >- The approved build currently served on web, or `null` when none is deployed. oneOf: - $ref: '#/components/schemas/AppProductionBuild' - type: 'null' redirect_uris: items: description: >- Whitelisted OAuth callback URLs users are redirected to after authorizing the app. example: https://booking.shinetime.example/oauth/callback type: string type: array requested_permissions: items: $ref: '#/components/schemas/AppRequestedPermission' description: Permissions the app requests on install. type: array required_scopes: items: description: >- Scopes the app asks a user to grant when they authorize it, shown on the consent screen. enum: - read_user example: read_user type: string type: array route: description: >- Claimed subdomain route where hosted web builds are served (`myapp` for myapp.whop.app), or `null` if no route is claimed. example: shine-time-booking type: - string - 'null' secrets: description: >- The app's production secrets as an object of string values, injected into the hosted server runtime. `null` when the caller lacks the `developer:update_app` permission. example: BOOKING_CALENDAR_ID: cal_9f21 type: - object - 'null' skills_path: description: >- URL path to the app's skills directory, or `null` when not configured. example: /skills type: - string - 'null' status: description: >- Visibility on the Whop app store: `live` is publicly discoverable, `unlisted` is accessible only via direct link, `hidden` is not visible anywhere. enum: - live - unlisted - hidden example: unlisted type: string verified: description: >- Whether the app has been verified by Whop and is eligible for the featured apps section. example: false type: boolean required: - id - name - description - status - base_url - domain_id - route - hosted_url - verified - app_type - origin - experience_path - discover_path - dashboard_path - skills_path - openapi_path - account - icon - banner_image - creator - businesses_created_count - businesses_created_logo_urls - app_store_description - requested_permissions - api_key - default_api_key - production_web_build - production_ios_build - production_android_build - redirect_uris - required_scopes - secrets - product_id - marketplace_status - oauth_client_type - deployment type: object AccountParent: properties: id: description: Account ID, prefixed `biz_`. example: biz_xxxxxxxxxxxxxx type: string logo_url: description: Account logo image URL. example: >- https://whop-assets-example.s3.amazonaws.com/uploads/image/2026-01-01/xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx type: - string - 'null' route: description: Account public route identifier. example: shine-time-holdings type: string title: description: Account display name. example: Shine Time Holdings type: string required: - id - title - route - logo_url type: object AppApiKey: properties: created_at: description: When the key was created, as an ISO 8601 timestamp. example: '2026-01-01T12:00:00.000Z' type: string token: description: >- The key's secret token, sent as a bearer token to authenticate requests on the app's behalf. example: >- eyJhbGciOiJFUzI1NiJ9.xxxxxxxxxxxxxxxxxxxxxxxx.xxxxxxxxxxxxxxxxxxxxxxxx type: string required: - token - created_at type: object AppBannerImage: properties: url: description: Banner image URL, taken from the app's product listing. example: >- https://whop-assets-example.s3.amazonaws.com/uploads/image/2026-01-01/xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx type: string required: - url type: object AppCreator: properties: id: description: User ID, prefixed `user_`. example: user_xxxxxxxxxxxxxx type: string name: description: Display name. example: Marcus Webb type: - string - 'null' username: description: Public username. example: marcuswebb type: string required: - id - name - username type: object AppDefaultApiKey: properties: id: description: API key ID, prefixed `apik_`. example: apik_xxxxxxxxxxxxxx type: string name: description: >- Human-readable name identifying the API key, or `null` when none was set. example: Default type: - string - 'null' obfuscated_secret_key: description: >- Masked version of the secret key, so the key can be recognized without revealing the full secret. example: apik_xxxx....xxxx type: string secret_key: description: >- The full secret used to authenticate requests. `null` unless the caller could have created the key themselves. example: >- apik_xxxxxxxxxxxxxx_C0000_C_xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx type: - string - 'null' required: - id - name - obfuscated_secret_key - secret_key type: object AppDeployment: properties: app_id: description: The app being deployed, prefixed `app_`. example: app_xxxxxxxxxxxxxx type: string build_id: description: >- The build the deployment produced, prefixed `abld_`, or `null` until it succeeds. type: - string - 'null' draft: description: >- Whether the running or last deployment uploaded a build without making it live. example: false type: boolean error: description: Why the deployment failed, or `null` when it did not. type: - string - 'null' estimated_duration_ms: description: >- How long this deployment is expected to take in total, estimated from previous runs. example: 150000 type: - integer - 'null' estimated_remaining_ms: description: >- How much longer the deployment is expected to take. Held above zero until it actually finishes. example: 91000 type: - integer - 'null' finished_at: description: >- When the deployment ended, in milliseconds since the epoch, or `null` while it is still running. type: - integer - 'null' phase: description: >- The stage a running deployment has reached, or `null` when none is running. Later phases dominate the wall clock: `process_archive` waits on the upload pipeline and `promote` waits for the build to go live. enum: - install - build - typecheck - upload_build - upload_source - process_archive - create_build - promote - null example: process_archive type: - string - 'null' progress: description: >- Fraction of the deployment estimated to be complete, from 0 to 1. Stops just short of 1 until the run ends. example: 0.39 type: - number - 'null' started_at: description: >- When the deployment began, in milliseconds since the epoch, or `null` when none has run. example: 1767268800000 type: - integer - 'null' status: description: >- Whether the app has anything to publish, and what a publish in flight is doing. `unpublished` means publishing would ship something new; `no_source` means the sandbox holds no copy of this app, so there is nothing to publish from. enum: - published - unpublished - publishing - failed - no_source example: publishing type: string url: description: >- Where the deployed site is served, or `null` unless the deployment went live. type: - string - 'null' required: - app_id - status - draft - phase - started_at - finished_at - estimated_duration_ms - estimated_remaining_ms - progress - build_id - url - error type: object AppIcon: properties: url: description: >- Icon image URL. Always present — the default app icon when none is uploaded. example: >- https://pub-xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx.r2.dev/custom-perk-icon.svg type: string required: - url type: object AppProductionBuild: properties: checksum: description: >- Client-generated checksum of the build file, used to verify file integrity. example: xxxxxxxxxxxxxxxx type: - string - 'null' file_url: description: URL to download the uploaded build artifact. example: >- https://whop-assets-example.s3.amazonaws.com/uploads/image/2026-01-01/xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx type: - string - 'null' id: description: App build ID, prefixed `abld_`. example: apbu_xxxxxxxxxxxxxx type: string source_url: description: >- URL to download the compressed source code archive that produced this build, or `null` when the build was uploaded without a source archive. example: >- https://whop-assets-example.s3.amazonaws.com/uploads/image/2026-01-01/xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx type: - string - 'null' status: description: The build's review status. enum: - draft - pending - approved - rejected example: approved type: string required: - id - file_url - source_url - checksum - status type: object AppRequestedPermission: properties: is_required: description: >- Whether the app requires the permission to be granted on install, as opposed to requesting it optionally. example: true type: boolean justification: description: >- The developer's explanation of why the app needs the permission, or `null` when none was provided. example: Creates apps on behalf of the installing company. type: - string - 'null' permission_action: $ref: '#/components/schemas/AppRequestedPermissionAction' description: The permission action the app requests. required: - permission_action - is_required - justification type: object V1ErrorResponse: properties: error: properties: code: description: >- Machine-readable reason for this specific refusal, such as `bank_warning_not_acknowledged`. Only present when the error carries one. type: string message: description: Human-readable error message. example: account_id is required type: string type: description: Machine-readable error code. example: bad_request type: string required: - type - message type: object required: - error type: object AppRequestedPermissionAction: properties: action: description: >- The permission action's identifier, for example `company:basic:read`. example: company:basic:read type: string name: description: Human-readable name of the action. example: company:basic:read type: string required: - action - name type: object responses: InvalidParameters: content: application/json: schema: $ref: '#/components/schemas/V1ErrorResponse' description: Invalid Parameters Unauthorized: content: application/json: schema: $ref: '#/components/schemas/V1ErrorResponse' description: Unauthorized Forbidden: content: application/json: schema: $ref: '#/components/schemas/V1ErrorResponse' description: Forbidden NotFound: content: application/json: schema: $ref: '#/components/schemas/V1ErrorResponse' description: Resource not found securitySchemes: bearerAuth: bearerFormat: auth-scheme description: >- An Account API key, account-scoped JWT, App API key, or user OAuth token. Prepend the key or token with `Bearer`, for example `Bearer ***************************`. scheme: bearer type: http ````