Log inTalk to us

Change a team's app

patch/v1/teams/{team_id}/apps/{app_id}
Requires an API key

Changing the scopes, UI origins or extensions raises the app's revision, so a consent given earlier cannot be reused (409 consent_outdated). Only Ivora administrators change visibility, each change in the team's audit trail; a first_party app's webhook_url and ui_origins change only by Ivora administrators (403 app_first_party_staff_only), each change in the audit trail with before and after; back to private is refused while the app is installed outside the team (409 app_installed_outside_team). Narrowing the requested scopes removes them from every install at once; widening them grants nothing until an installer consents again. A developer limited to some projects is refused (403) while the app is installed in a project outside them.

Path parameters

  • team_idstringRequired
    Pattern ^team_[0-9a-f]{32}$
  • app_idstringRequired
    Pattern ^app_[0-9a-f]{32}$

Request body

  • namestring | null
    2–80 characters
  • descriptionstring | null
    Up to 500 characters
  • icon_urlstring | null
    Up to 512 characters
  • ui_originsarray of string | null
  • extensionsarray of Extension | null
    Child attributes
    • pointenumRequired
      Where the dashboard shows the app: a project tab, a panel on a station or a session, an overview widget, or an action (a button on a station or session that opens the app).
      One of project.tab, station.panel, session.panel, overview.widget, action
    • pathstringRequired
      The page on the app's UI origin, starting with /.
      1–200 characters
    • titlestring | null
      The tab, panel or action label; required except for widgets.
      1–60 characters
    • targetenum | null
      For an action: the page it appears on.
      One of station, session
    • sizeenum | null
      For a widget: its size on the overview grid.
      One of 1x1, 2x1, 2x2
  • scopesarray of string | null
    Project scopes. Never billing:refund or stations:admin, and never staff or API-key routes.
  • webhook_urlstring | null
    Up to 512 characters
  • checkout_serviceboolean | null
    Whether Ivora trusts the app's backend to name the driver's IP address (X-Ivora-Driver-Address) on payment creation, so the 30-a-minute per-address limit counts per driver: honoured only on a client_credentials token of an install holding billing:write, never on a session or exchanged token. Only Ivora administrators set it (403 otherwise), on an app that requests billing:write.
  • visibilityenum | null
    private: only the owning team's projects can install it. first_party: Ivora's own app, installable by every project and shown as made by Ivora; only Ivora administrators set it (403 otherwise). Back to private is refused (409 app_installed_outside_team) while the app is installed in a project outside its team.
    One of private, first_party

Returns · 200

  • idstringRequired
  • team_idstringRequired
  • namestringRequired
  • descriptionstring | nullRequired
  • icon_urlstring | nullRequired
  • ui_originsarray of stringRequired
  • extensionsarray of objectRequired
  • scopesarray of stringRequired
    The scopes the app requests; an install holds the part its installer consented to.
  • webhook_urlstring | nullRequired
    Null for a first_party app read from another team's project.
  • revisionintegerRequired
    Counts the changes to the app's scopes, origins and extensions. A consent is valid only for the revision it was given on.
  • visibilityenumRequired
    private: only the owning team's projects can install it. first_party: Ivora's own app, installable by every project and shown as made by Ivora; only Ivora administrators set it (403 otherwise).
    One of private, first_party
  • publisherstring | null
    Ivora for a first_party app, which the dashboard shows as made by Ivora; null: the team that registered it.
  • statusenumRequired
    One of active, archived
  • checkout_servicebooleanRequired
    Whether Ivora trusts the app's backend to name the driver's IP address (X-Ivora-Driver-Address) on payment creation, so the 30-a-minute per-address limit counts per driver: honoured only on a client_credentials token of an install holding billing:write, never on a session or exchanged token. Only Ivora administrators set it (403 otherwise), on an app that requests billing:write.
  • secret_prefixstring | nullRequired
    The client secret's first characters, to recognise it; the secret is shown only when it is created or rotated. Null for a first_party app read from another team's project.
  • secret_rotated_atstring | nullRequired
  • created_bystring | nullRequired
    Null for a first_party app read from another team's project.
  • created_atstringRequired
  • updated_atstringRequired
  • installsinteger | null
    Active installs, in the team's projects.
PATCH /v1/teams/{team_id}/apps/{app_id}
curl --fail-with-body -X PATCH "https://api.ivoracharge.com/v1/teams/team_0123456789abcdef0123456789abcdef/apps/app_0123456789abcdef0123456789abcdef" \
  -H "Authorization: Bearer $IVORA_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{}'
Response · 200JSON
{
  "id": "id_0123456789abcdef",
  "team_id": "team_0123456789abcdef",
  "name": "bay-01",
  "description": "string",
  "icon_url": "https://app.example.com/return",
  "ui_origins": [
    "string"
  ],
  "extensions": [
    {}
  ],
  "scopes": [
    "string"
  ],
  "webhook_url": "https://app.example.com/return",
  "revision": 1,
  "visibility": "private",
  "publisher": "Ivora",
  "status": "active",
  "checkout_service": false,
  "secret_prefix": "string",
  "secret_rotated_at": "2026-09-30T17:00:00Z",
  "created_by": "string",
  "created_at": "2026-09-30T17:00:00Z",
  "updated_at": "2026-09-30T17:00:00Z",
  "installs": 1
}
Requires an approved production API keyProduction access starts with a request, a short meeting with Ivora and a card on file, after which Ivora staff grant your account access. How to request access
Try itproduction · api.ivoracharge.com

Paste a production api key (iv_live_…). Create keys in Developer tools. The key stays in this page's memory, is sent only to https://api.ivoracharge.com and clears when you reload. Test keys are refused.

PATCH is a write: you confirm the method, path and project before it is sent, with a generated Idempotency-Key.