> ## Documentation Index
> Fetch the complete documentation index at: https://docs.base44.com/llms.txt
> Use this file to discover all available pages before exploring further.
> ## Agent Instructions
> Internal links on these pages omit the .md extension. Append .md to a docs page URL, or send an Accept: text/markdown header, to get that page as markdown.
# Patch app
> This API is in beta. Endpoints, fields, and behavior may still change, so avoid depending on it in production.
Changes the app's details and settings. That covers its name and description, who can open it, how people sign in, and a few display settings.
Send only the fields you want to change. A field you leave out keeps its value, and so does a login method you leave out of `auth_config`. [Update app](/api-reference/update-app) and [Patch app](/api-reference/patch-app) make the same update. Patch app answers errors in the standard error format.
Renaming doesn't change the app's address. Change that with [Change app slug](/api-reference/change-app-slug).
A new `public_settings` value applies to the published app right away, and so does whether others can remix the app. Changes to `auth_config`, the Base44 badge, and `hide_entity_created_by` take effect on the published app once you [deploy the app](/api-reference/deploy-an-app), or sooner if a `public_settings` change carries them along.
Limited to 60 requests a minute per caller.
This endpoint also accepts other app fields, but only the fields documented here are part of this API. Don't send anything else. Other fields aren't covered by the contract and can change or be rejected without notice.
## OpenAPI
````yaml /developers/references/app-management/app-management-openapi.json patch /api/apps/{app_id}
openapi: 3.1.0
info:
title: Base44 App Management API
version: 1.0.0
servers:
- url: https://app.base44.com
security:
- PersonalAccessTokenAuth: []
paths:
/api/apps/{app_id}:
patch:
summary: Patch app
description: >-
This API is in beta. Endpoints, fields, and behavior may still
change, so avoid depending on it in production.
Changes the app's details and settings. That covers its name and
description, who can open it, how people sign in, and a few display
settings.
Send only the fields you want to change. A field you leave out keeps its
value, and so does a login method you leave out of `auth_config`.
[Update app](/api-reference/update-app) and [Patch
app](/api-reference/patch-app) make the same update. Patch app answers
errors in the standard error format.
Renaming doesn't change the app's address. Change that with [Change app
slug](/api-reference/change-app-slug).
A new `public_settings` value applies to the published app right away,
and so does whether others can remix the app. Changes to `auth_config`,
the Base44 badge, and `hide_entity_created_by` take effect on the
published app once you [deploy the app](/api-reference/deploy-an-app),
or sooner if a `public_settings` change carries them along.
Limited to 60 requests a minute per caller.
This endpoint also accepts other app fields, but only the
fields documented here are part of this API. Don't send anything else.
Other fields aren't covered by the contract and can change or be
rejected without notice.
operationId: api_patch_api_apps__item_id__patch
parameters:
- name: app_id
in: path
required: true
schema:
title: App Id
description: ID of the app.
example: 6820f3a4e7b91d003c45a1f2
requestBody:
required: true
content:
application/json:
schema:
title: UpdateApp
type: object
properties:
name:
type: string
description: New name for the app.
example: Nordwind Furniture
user_description:
anyOf:
- type: string
- type: 'null'
description: New description for the app, or `null` to remove it.
example: >-
An online catalog and order tracker for a furniture
workshop.
public_settings:
type: string
enum:
- public_without_login
- public_with_login
- workspace_with_login
- private_with_login
description: >-
Who can open the published app. `public_without_login` lets
anyone in, unless the workspace enforces SSO for apps, in
which case visitors must log in. `public_with_login` lets
anyone in who logs in, `workspace_with_login` admits only
logged-in members of the workspace, and `private_with_login`
admits only users who were granted access. Switching to
`workspace_with_login` or `private_with_login` needs a paid
plan, and a workspace policy can restrict which values you
can choose. An agent app always stays `private_with_login`.
example: public_with_login
auth_config:
type: object
description: >-
Which login methods the app's login page offers. Send only
the methods you want to change. If the workspace enforces
SSO for apps, the login page offers only SSO, whatever these
are set to. Set up the app's own SSO provider with [Update
app SSO settings](/api-reference/update-app-sso-settings).
properties:
enable_username_password:
type: boolean
description: >-
`true` lets people sign in with an email and password,
and `false` removes that option.
example: true
enable_google_login:
type: boolean
description: >-
`true` lets people sign in with a Google account, and
`false` removes that option.
example: true
enable_microsoft_login:
type: boolean
description: >-
`true` lets people sign in with a Microsoft account, and
`false` removes that option.
example: true
enable_facebook_login:
type: boolean
description: >-
`true` lets people sign in with a Facebook account, and
`false` removes that option.
example: true
enable_apple_login:
type: boolean
description: >-
`true` lets people sign in with an Apple account, and
`false` removes that option.
example: true
example:
enable_username_password: true
enable_google_login: false
is_remixable:
type: boolean
description: >-
`true` shows the Base44 badge on the published app and lets
others remix it. The badge only shows while the app is
`public_with_login` or `public_without_login`. `false` hides
the badge and turns remixing off, which needs a paid plan on
the app's workspace.
example: false
hide_entity_created_by:
type: boolean
description: >-
`true` leaves the email of the user who created each record
(`created_by`) out of the app's entity records, and `false`
includes it. `created_by_id` is always included. Newer apps
always leave the email out and ignore this field.
example: true
dev_environment_enabled:
type: boolean
description: >-
`true` turns on test data. The app gets a test database next
to its live one, so you can try changes in the preview
without touching live data. Turning it on needs a Builder
plan or higher on the app's workspace. `false` turns it off.
example: true
example:
name: Nordwind Furniture
public_settings: public_with_login
responses:
'200':
description: The app, with its new details.
content:
application/json:
schema:
$ref: '#/components/schemas/UserApp'
example:
id: 67e0b12c4d8a3f005b21c9f1
name: Nordwind Furniture
organization_id: 67e0b12c4d8a3f005b21c9e4
public_settings: public_with_login
slug: nordwind-furniture
'400':
description: >-
`invalid_request`: the app is an agent and `public_settings` isn't
`private_with_login`, or the body's `id` isn't this app's.
content:
application/json:
schema:
$ref: '#/components/schemas/StandardErrorEnvelope'
'401':
description: '`unauthenticated`: missing or invalid credentials.'
content:
application/json:
schema:
$ref: '#/components/schemas/StandardErrorEnvelope'
'402':
description: >-
`upgrade_required`: the workspace plan doesn't include the
`public_settings` value you sent, or test data.
content:
application/json:
schema:
$ref: '#/components/schemas/StandardErrorEnvelope'
'403':
description: >-
`forbidden`: you don't have access to this app, it doesn't exist, or
your token is read-only. Also returned when the workspace policy
doesn't allow the `public_settings` value you sent, or when you set
`is_remixable` to `false` without a paid plan.
content:
application/json:
schema:
$ref: '#/components/schemas/StandardErrorEnvelope'
'422':
description: >-
`invalid_request`: a field has the wrong type, or `public_settings`
isn't one of its allowed values.
content:
application/json:
schema:
$ref: '#/components/schemas/StandardErrorEnvelope'
'429':
description: '`rate_limited`: more than 60 requests a minute per caller.'
content:
application/json:
schema:
$ref: '#/components/schemas/StandardErrorEnvelope'
security:
- PersonalAccessTokenAuth:
- full_access
components:
schemas:
UserApp:
properties:
id:
type: string
title: Id
description: ID of the app.
example: 6820f3a4e7b91d003c45a1f2
created_date:
type: string
format: date-time
title: Created Date
description: Time the app was created, as a UTC timestamp in ISO 8601 format.
example: '2026-08-01T09:15:00'
updated_date:
type: string
format: date-time
title: Updated Date
description: >-
Time the app document was last written, as a UTC timestamp in ISO
8601 format.
example: '2026-08-02T14:30:00'
created_by:
anyOf:
- type: string
- type: 'null'
title: Created By
description: Email of the user who created the app.
example: developer@example.com
organization_id:
anyOf:
- type: string
- type: 'null'
title: Organization Id
description: ID of the workspace the app belongs to.
example: 67e0b12c4d8a3f005b21c9e4
app_type:
type: string
title: App Type
description: >-
Kind of app, set when it's created. One of `user_app` (a web app),
`user_agent` (an AI agent), `mobile_app` (a native mobile app),
`user_game` (a game), `slide` (a presentation), or `imported_app`
(an app imported from an existing code repository). List apps
returns it as stored, so an older agent app can report `agent`
instead of `user_agent`, and some older apps don't include it. Get
app always returns one of the values above.
default: user_app
example: user_app
name:
type: string
title: Name
description: Display name of the app.
default: untitled
example: My CRM
user_description:
anyOf:
- type: string
- type: 'null'
title: User Description
description: >-
Description of the app, or `null` if none was set. An app created
without a `name` gets a generated description once a build turn
changes it.
example: A CRM to track leads and deals
logo_url:
anyOf:
- type: string
- type: 'null'
title: Logo Url
description: >-
URL of the app's logo, or `null` if it has none. Set it with [Set
app logo](/api-reference/set-app-logo) or [Generate app
logo](/api-reference/generate-app-logo).
example: >-
https://storage.base44.com/6820f3a4e7b91d003c45a1f2/3f2504e0_logo.png
social_image_url:
anyOf:
- type: string
- type: 'null'
title: Social Image Url
description: >-
URL of the image shown when the app is shared on social platforms,
or `null` if none was set, in which case the logo is shown instead.
Set it with [Set social image](/api-reference/set-social-image).
example: >-
https://storage.base44.com/6820f3a4e7b91d003c45a1f2/7c9e6679_social.png
public_settings:
type: string
enum:
- private_with_login
- public_with_login
- public_without_login
- workspace_with_login
title: Public Settings
description: >-
Who can open the published app. Each value is described under
[Update app](/api-reference/update-app), which also changes it.
default: public_with_login
example: public_with_login
auth_config:
$ref: '#/components/schemas/AuthConfiguration'
description: >-
Which login methods the app's login page offers. If the workspace
enforces SSO for apps, the login page offers only SSO, whatever
these are set to. Change them with [Update
app](/api-reference/update-app).
hide_entity_created_by:
type: boolean
title: Hide Entity Created By
description: >-
Whether the app's entity records leave out the email of the user who
created each one (`created_by`). Newer apps always leave the email
out, whatever this is set to.
default: false
example: true
is_remixable:
type: boolean
title: Is Remixable
description: >-
Whether others can remix the app. While it's `true`, the published
app also shows the Base44 badge if `public_settings` is
`public_with_login` or `public_without_login`.
default: false
example: false
main_branch_protected:
type: boolean
title: Main Branch Protected
description: >-
Whether the app's main branch is protected, so changes to main must
go through a branch that's merged back. Always `true` for imported
apps. Change it with [Set main branch
protection](/api-reference/set-main-branch-protection).
default: false
example: false
slug:
anyOf:
- type: string
- type: 'null'
title: Slug
description: >-
URL slug for the app, auto generated from the name and app ID or set
to a custom value, or `null` if the app has no slug yet. The
published URL is built from it.
example: my-crm-3c45a1f2
is_unpublished:
type: boolean
title: Is Unpublished
description: >-
Whether the app was taken offline with [Unpublish
app](/api-reference/unpublish-app) and hasn't been published again
since. While it's `true`, the published URL is offline and
`last_deployed_at` still shows the last publish.
default: false
example: false
last_deployed_at:
anyOf:
- type: string
format: date-time
- type: 'null'
title: Last Deployed At
description: >-
Time the app was last published, as a UTC timestamp in ISO 8601
format, or `null` if it has never been published.
example: '2026-08-02T14:30:00'
screenshot_url:
anyOf:
- type: string
- type: 'null'
title: Screenshot Url
description: >-
URL of a screenshot of the published app. Captured shortly after
each publish, so it can briefly lag or be `null` right after
publishing.
example: https://storage.base44.com/screenshots/6820f3a4e7b91d003c45a1f2.png
preview_screenshot_url:
anyOf:
- type: string
- type: 'null'
title: Preview Screenshot Url
description: >-
URL of a preview screenshot taken before publishing, distinct from
`screenshot_url`, or `null` if none has been captured.
example: https://storage.base44.com/previews/6820f3a4e7b91d003c45a1f2.png
owner_id:
anyOf:
- type: string
- type: 'null'
title: Owner Id
description: >-
ID of the user who owns the app. It starts as the creator and
changes when ownership is transferred.
example: 6706af53b9c1e2004a37d85f
status:
$ref: '#/components/schemas/StatusObject'
description: >-
The app's current build status. Poll while a build is in progress to
watch it finish. This tracks building, not publishing.
dev_environment_enabled:
type: boolean
title: Dev Environment Enabled
description: >-
Whether test data is on, which gives the app a test database next to
its live one.
default: false
example: false
type: object
title: UserApp
StandardErrorEnvelope:
properties:
error:
$ref: '#/components/schemas/StandardError'
description: What went wrong.
type: object
required:
- error
title: StandardErrorEnvelope
description: The error body returned in the standard envelope.
AuthConfiguration:
properties:
enable_username_password:
type: boolean
title: Enable Username Password
description: Whether people can sign in to the app with an email and password.
default: false
example: true
enable_google_login:
type: boolean
title: Enable Google Login
description: Whether people can sign in to the app with a Google account.
default: true
example: true
enable_microsoft_login:
type: boolean
title: Enable Microsoft Login
description: Whether people can sign in to the app with a Microsoft account.
default: false
example: false
enable_facebook_login:
type: boolean
title: Enable Facebook Login
description: Whether people can sign in to the app with a Facebook account.
default: false
example: false
enable_apple_login:
type: boolean
title: Enable Apple Login
description: Whether people can sign in to the app with an Apple account.
default: false
example: false
type: object
title: AuthConfiguration
description: Authentication configuration for user applications
StatusObject:
properties:
state:
type: string
enum:
- ready
- processing
- error
title: State
description: >-
Where the app is in its build lifecycle. Ready means idle with no
build in progress, processing means the app is being generated or
modified, and error means the last build failed. This tracks
building, not publishing.
example: ready
details:
anyOf:
- type: string
- type: 'null'
title: Details
description: >-
Human readable note about the current state, such as what is being
processed or why it failed, or `null` when there is nothing to
report.
example: Publishing app
request_id:
anyOf:
- type: string
- type: 'null'
title: Request Id
description: >-
ID of the request that last changed the status, or `null` if the
status has never changed. Useful when reporting an issue.
example: a1b2c3d4e5f67890abcdef12
last_updated_date:
anyOf:
- type: string
format: date-time
- type: 'null'
title: Last Updated Date
description: >-
Time the status was last updated, as a UTC timestamp in ISO 8601
format.
example: '2026-08-02T14:30:00Z'
error_source:
anyOf:
- type: string
- type: 'null'
title: Error Source
description: >-
Where the failure originated when `state` is `error`, or `null`
otherwise. A value of `paywall` means the work was blocked because
the app's workspace has no credits left.
example: build
paywall_context:
anyOf:
- $ref: '#/components/schemas/PaywallStatusContext'
- type: 'null'
description: >-
Present when the operation was blocked by a plan limit, describing
what was evaluated, or `null` otherwise.
type: object
required:
- state
title: StatusObject
description: The app's current build status.
StandardError:
properties:
code:
type: string
title: Code
description: >-
Stable machine-readable cause of the failure. Match on this, not on
`message`.
example: not_found
message:
type: string
title: Message
description: Human-readable explanation. It isn't a stable contract.
example: App not found
details:
additionalProperties: true
type: object
title: Details
description: >-
Structured context for the failure, or an empty object when there's
none.
example: {}
type: object
required:
- code
- message
title: StandardError
PaywallStatusContext:
properties:
billing_organization_id:
type: string
title: Billing Organization Id
description: ID of the billing organization the paywall was evaluated against.
example: 67e0b12c4d8a3f005b21c9e4
user_id:
type: string
title: User Id
description: ID of the user the paywall was evaluated for.
example: 6706af53b9c1e2004a37d85f
evaluated_at:
type: string
format: date-time
title: Evaluated At
description: >-
Time the paywall condition was evaluated, as a UTC timestamp in ISO
8601 format.
example: '2026-08-02T14:30:00Z'
type: object
required:
- billing_organization_id
- user_id
- evaluated_at
title: PaywallStatusContext
securitySchemes:
PersonalAccessTokenAuth:
type: http
scheme: bearer
description: >-
Personal access token, sent as `Authorization: Bearer `. Each
operation lists the permission it needs: `read_only` or `full_access`. A
full-access token can call every operation. A read-only token can call
only the operations that list `read_only`; anything else returns 403
`read_only_credential_route_not_allowed`.
````
This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.