Change a team's app
Changing the scopes, UI origins or extensions raises the app's revision, so a consent given earlier cannot be reused (409 consent_outdated). Only Ivora administrators change visibility, each change in the team's audit trail; a first_party app's webhook_url and ui_origins change only by Ivora administrators (403 app_first_party_staff_only), each change in the audit trail with before and after; back to private is refused while the app is installed outside the team (409 app_installed_outside_team). Narrowing the requested scopes removes them from every install at once; widening them grants nothing until an installer consents again. A developer limited to some projects is refused (403) while the app is installed in a project outside them.
Path parameters
- team_idstringRequiredPattern
^team_[0-9a-f]{32}$ - app_idstringRequiredPattern
^app_[0-9a-f]{32}$
Request body
- namestring | null2–80 characters
- descriptionstring | nullUp to 500 characters
- icon_urlstring | nullUp to 512 characters
- ui_originsarray of string | null
- extensionsarray of Extension | null
Child attributes
- pointenumRequiredWhere the dashboard shows the app: a project tab, a panel on a station or a session, an overview widget, or an action (a button on a station or session that opens the app).One of
project.tab,station.panel,session.panel,overview.widget,action - pathstringRequiredThe page on the app's UI origin, starting with /.1–200 characters
- titlestring | nullThe tab, panel or action label; required except for widgets.1–60 characters
- targetenum | nullFor an action: the page it appears on.One of
station,session - sizeenum | nullFor a widget: its size on the overview grid.One of
1x1,2x1,2x2
- scopesarray of string | nullProject scopes. Never billing:refund or stations:admin, and never staff or API-key routes.
- webhook_urlstring | nullUp to 512 characters
- checkout_serviceboolean | nullWhether Ivora trusts the app's backend to name the driver's IP address (X-Ivora-Driver-Address) on payment creation, so the 30-a-minute per-address limit counts per driver: honoured only on a client_credentials token of an install holding billing:write, never on a session or exchanged token. Only Ivora administrators set it (403 otherwise), on an app that requests billing:write.
- visibilityenum | nullprivate: only the owning team's projects can install it. first_party: Ivora's own app, installable by every project and shown as made by Ivora; only Ivora administrators set it (403 otherwise). Back to private is refused (409 app_installed_outside_team) while the app is installed in a project outside its team.One of
private,first_party
Returns · 200
- idstringRequired
- team_idstringRequired
- namestringRequired
- descriptionstring | nullRequired
- icon_urlstring | nullRequired
- ui_originsarray of stringRequired
- extensionsarray of objectRequired
- scopesarray of stringRequiredThe scopes the app requests; an install holds the part its installer consented to.
- webhook_urlstring | nullRequiredNull for a first_party app read from another team's project.
- revisionintegerRequiredCounts the changes to the app's scopes, origins and extensions. A consent is valid only for the revision it was given on.
- visibilityenumRequiredprivate: only the owning team's projects can install it. first_party: Ivora's own app, installable by every project and shown as made by Ivora; only Ivora administrators set it (403 otherwise).One of
private,first_party - publisherstring | nullIvora for a first_party app, which the dashboard shows as made by Ivora; null: the team that registered it.
- statusenumRequiredOne of
active,archived - checkout_servicebooleanRequiredWhether Ivora trusts the app's backend to name the driver's IP address (X-Ivora-Driver-Address) on payment creation, so the 30-a-minute per-address limit counts per driver: honoured only on a client_credentials token of an install holding billing:write, never on a session or exchanged token. Only Ivora administrators set it (403 otherwise), on an app that requests billing:write.
- secret_prefixstring | nullRequiredThe client secret's first characters, to recognise it; the secret is shown only when it is created or rotated. Null for a first_party app read from another team's project.
- secret_rotated_atstring | nullRequired
- created_bystring | nullRequiredNull for a first_party app read from another team's project.
- created_atstringRequired
- updated_atstringRequired
- installsinteger | nullActive installs, in the team's projects.
curl --fail-with-body -X PATCH "https://api.ivoracharge.com/v1/teams/team_0123456789abcdef0123456789abcdef/apps/app_0123456789abcdef0123456789abcdef" \
-H "Authorization: Bearer $IVORA_API_KEY" \
-H "Content-Type: application/json" \
-d '{}'{
"id": "id_0123456789abcdef",
"team_id": "team_0123456789abcdef",
"name": "bay-01",
"description": "string",
"icon_url": "https://app.example.com/return",
"ui_origins": [
"string"
],
"extensions": [
{}
],
"scopes": [
"string"
],
"webhook_url": "https://app.example.com/return",
"revision": 1,
"visibility": "private",
"publisher": "Ivora",
"status": "active",
"checkout_service": false,
"secret_prefix": "string",
"secret_rotated_at": "2026-09-30T17:00:00Z",
"created_by": "string",
"created_at": "2026-09-30T17:00:00Z",
"updated_at": "2026-09-30T17:00:00Z",
"installs": 1
}Try itproduction · api.ivoracharge.com
Paste a production api key (iv_live_…). Create keys in Developer tools. The key stays in this page's memory, is sent only to https://api.ivoracharge.com and clears when you reload. Test keys are refused.
PATCH is a write: you confirm the method, path and project before it is sent, with a generated Idempotency-Key.



