Partially update an App

patch

https://{region}.api.jamfcloud.com/securitycloud/v1/ztna/apps/{appId}

Partially update an App (Access Policy).
All fields are optional — include only what you want to change.

Returns 404 if the App does not exist or is not owned by this customer.

Server-side partial merge — fields are merged atomically. No client-side
read-modify-write cycle.

name: "" is rejected. Sending a blank string for name returns 400.
Ignored when predefinedAppId is set. Omit name entirely to leave it unchanged.

Full-tunnel restriction: When hostnames contains "*" (wildcard — routes all traffic),
security.riskControls.enabled must be false — returns 400 otherwise.

Required Permissions: ztna:update

Recent Requests

Time	Status	User Agent
Retrieving recent requests…

Loading…

Path Params

appId

uuid

required

ID of the App (Access Policy). Format: UUID (e.g. 3fa85f64-5717-4562-b3fc-2c963f66afa6).

Body Params

Merge-patch body (application/merge-patch+json) for partial App update. All fields optional — include only what you want to change.

name

string

length ≥ 1

New name. Must be non-empty — a blank string returns 400. Ignored when predefinedAppId is set (name is owned by the template). Omit to leave unchanged.

categoryName

string

length ≥ 1

App category name. Must exactly match a displayName returned by GET /v1/categories (e.g. "Business & Industry") — that endpoint is the authoritative source. Unknown values return 409 MISSING_CATEGORY_NAME — the category list is server-owned and may change, so an unrecognized name is a state conflict, not a malformed request.

hostnames

array of strings, unique

Replaces the full hostname list. Each entry must be a valid domain name, "*", or "*.domain". Overlapping entries (e.g. ["*.example.com", "sub.example.com"]) return 400. Specifying the same hostname as another App returns 409.

hostnames

bareIps

array of strings, unique

Replaces the full bareIps list. IPv4 CIDR subnets (e.g. 192.168.1.0/24).

bareIps

assignments

object

User/group assignment rules for an App.

routing

object

Traffic routing configuration for an App.

groupOverrides

object

Per-group routing overrides that take precedence over the App's default routing. Each override's groupIds must be a subset of assignments.inclusions.groups (or allUsers: true); references to unassigned groups return 400.

security

object

Security controls applied to App traffic.

Headers

X-Tenant-Id

uuid

^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$

The tenant UUID identifier. Send it to address tenant scope. This API is also published at environment scope — send that scope's header instead. Send exactly one scope header per request.

X-Environment-Id

uuid

^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$

The environment UUID identifier. Send it to address environment scope. This API is also published at tenant scope — send that scope's header instead. Send exactly one scope header per request.

Responses

204

App updated.

404

App not found or not owned by this customer.

Language

Credentials

OAuth2

URL

Loading…

Response

Click Try It! to start a request and see the response here! Or choose an example:

application/json

400Bad request — validation error. Common codes: INVALID_FIELD (schema or constraint violation), IPSEC_SECRET_CLEAR_NOT_SUPPORTED (explicit null sent for ipsec.left.secret), IPSEC_REMOVAL_NOT_SUPPORTED (explicit null sent for ipsec on a gateway that has IPSec configured).

429Rate limit exceeded. Retry after the period indicated by Retry-After.