Update an application
Updates an application’s top-level attributes (title, description, URL, status, owner, and risk level). Supports optimistic locking: include the current lock_version to guard against concurrent edits, which returns a conflict if the application has changed since you read it. To modify resources and permissions, use the update-structure endpoint.
Authorizations
Bearer token authentication. Pass your AccessOwl API token in the Authorization header as Bearer <token>.
Headers
Optional key (1–255 chars) for safely retrying a request. Reusing the same key for the same request returns 409 Conflict and is not processed again — this confirms the request was already received. Keys are retained for 14 days.
1 - 255Path Parameters
Body
Application update parameters
Request body for updating an application's scalar fields. Reject keys: resources, permissions, policy_ids.
User IDs of the application's admins. Send [] to clear; unknown IDs return 422.
Authentication method used to sign in
google, microsoft, okta, sso_provider, credentials, other Where the vendor stores data
Date of the last vendor security review
Optimistic lock version. Optional; if stale, returns 409.
Whether MFA is activated for this application
Internal notes
Data-processing-scope slugs. Send [] to clear; unknown slugs return 422.
customer_metadata, customer_pii, company_metadata, company_sensitive_data, employee_pii, employee_sensitive_data, ephi low, medium, high ignored, approved, requestable Tag titles. New titles are created automatically; send [] to clear.
URL where existing users are shown and new users are invited
Security/compliance certifications held by the vendor
iso_22301, iso_27001, iso_27017, iso_27701, iso_31000, iso_42001, soc1, soc2_t1, soc2_t2, soc3, pci_dss, nist_csf, fed_ramp, hipaa, hitrust_csf, gdpr, csa_star, fsd_safe Response
Application
An application in the organization
Application ID
Application status
ignored, discovered, approved, requestable Application title
User IDs of the application's admins
Authentication method used to sign in
google, microsoft, okta, sso_provider, credentials, other Where the vendor stores data
Description
Creation timestamp
Date of the last vendor security review
Whether MFA is activated for this application
Internal notes
Owner user ID
Types of data this application processes
customer_metadata, customer_pii, company_metadata, company_sensitive_data, employee_pii, employee_sensitive_data, ephi Provisioning type
application_admin, automatic Risk level assessment
low, medium, high Tags assigned to this application
Last update timestamp
Application URL
Number of users with access
URL where existing users are shown and new users are invited
Security/compliance certifications held by the vendor
iso_22301, iso_27001, iso_27017, iso_27701, iso_31000, iso_42001, soc1, soc2_t1, soc2_t2, soc3, pci_dss, nist_csf, fed_ramp, hipaa, hitrust_csf, gdpr, csa_star, fsd_safe