# Update an application

`PATCH /v1/applications/{application_id}` · permission `applications:write`

Updates an application with a JSON Merge Patch (`application/merge-patch+json`, RFC 7396): fields you send change, `null` clears a nullable field, arrays are replaced as a whole. `If-Match` is required: without it the request fails with `428`, with a stale version with `412`. The immutable fields `key`, `app_type`, `registration_source` and `owner_org_id` return `422` with code `immutable` if you send a different value. A patch that changes nothing leaves the application and its version untouched.

## Request

**Headers**: `If-Match: "<version>"` (required), `Content-Type: application/merge-patch+json`.

**Path**: `application_id` (`app_…`).

**Body**: any subset of the writable fields listed on the create page (`key`, `name`, `app_type`, … `connection_ids`). `null` clears a field that is nullable; arrays replace the whole list; `jwks` is replaced as an object. Read-only fields (`id`, `client_id`, `version`, `created_at`, `updated_at`, `last_token_issued_at`, `last_token_asn`) are rejected.

## Response

`200 OK` with the updated application and the new `ETag`.

## Errors

| HTTP | `code` | When |
|---|---|---|
| 401 | `unauthenticated` | The key is missing, invalid or revoked. |
| 403 | `insufficient_permissions` | The key lacks the required permission. |
| 404 | `not_found` | The application does not exist in this environment. |
| 428 | `precondition_required` | `If-Match` header is missing. |
| 412 | `precondition_failed` | The version in `If-Match` is stale. |
| 422 | `validation_failed` | A field is invalid or an immutable field changed. |
| 422 | `policy_conflict` | `allowed_first_factors` has no method in common with the environment's first-factor set. |
| 400 | `unknown_field` | The patch has a field that is not part of the schema (including read-only fields such as `id`). |
| 415 | `unsupported_media_type` | `Content-Type` is not `application/merge-patch+json`. |

## Example

```bash
curl -X PATCH https://api.eu.keenauth.com/v1/applications/app_6f8d0cjgbmf0gtn2rg6pscp3cg \
  -H "Authorization: Bearer $KEENAUTH_SECRET_KEY" \
  -H "Content-Type: application/merge-patch+json" \
  -H 'If-Match: "1"' \
  -d '{"name":"Portal v2","login_host":null}'
```