curl -X PATCH "https://apx.didit.me/auth/v2/organizations/me/$ORG_ID/applications/$APP_ID/" \
-H "Authorization: Bearer $ACCESS_TOKEN" \
-H "Content-Type: application/json" \
-d '{
"name": "Acme Production App",
"website_url": "https://app.acme.example"
}'import requests
resp = requests.patch(
f"https://apx.didit.me/auth/v2/organizations/me/{org_id}/applications/{app_id}/",
headers={"Authorization": f"Bearer {access_token}"},
json={
"name": "Acme Production App",
"website_url": "https://app.acme.example",
},
timeout=10,
)
resp.raise_for_status()
updated = resp.json()const resp = await fetch(
`https://apx.didit.me/auth/v2/organizations/me/${orgId}/applications/${appId}/`,
{
method: "PATCH",
headers: {
Authorization: `Bearer ${accessToken}`,
"Content-Type": "application/json",
},
body: JSON.stringify({
name: "Acme Production App",
website_url: "https://app.acme.example",
}),
},
);
if (!resp.ok) throw new Error(`Update app failed: ${resp.status}`);
const updated = await resp.json();<?php
$curl = curl_init();
curl_setopt_array($curl, [
CURLOPT_URL => "https://apx.didit.me/auth/v2/organizations/me/{org_id}/applications/{app_id}/",
CURLOPT_RETURNTRANSFER => true,
CURLOPT_ENCODING => "",
CURLOPT_MAXREDIRS => 10,
CURLOPT_TIMEOUT => 30,
CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
CURLOPT_CUSTOMREQUEST => "PATCH",
CURLOPT_POSTFIELDS => json_encode([
'name' => 'Acme Production App',
'website_url' => 'https://app.acme.example'
]),
CURLOPT_HTTPHEADER => [
"Authorization: Bearer <token>",
"Content-Type: application/json"
],
]);
$response = curl_exec($curl);
$err = curl_error($curl);
curl_close($curl);
if ($err) {
echo "cURL Error #:" . $err;
} else {
echo $response;
}package main
import (
"fmt"
"strings"
"net/http"
"io"
)
func main() {
url := "https://apx.didit.me/auth/v2/organizations/me/{org_id}/applications/{app_id}/"
payload := strings.NewReader("{\n \"name\": \"Acme Production App\",\n \"website_url\": \"https://app.acme.example\"\n}")
req, _ := http.NewRequest("PATCH", url, payload)
req.Header.Add("Authorization", "Bearer <token>")
req.Header.Add("Content-Type", "application/json")
res, _ := http.DefaultClient.Do(req)
defer res.Body.Close()
body, _ := io.ReadAll(res.Body)
fmt.Println(string(body))
}HttpResponse<String> response = Unirest.patch("https://apx.didit.me/auth/v2/organizations/me/{org_id}/applications/{app_id}/")
.header("Authorization", "Bearer <token>")
.header("Content-Type", "application/json")
.body("{\n \"name\": \"Acme Production App\",\n \"website_url\": \"https://app.acme.example\"\n}")
.asString();require 'uri'
require 'net/http'
url = URI("https://apx.didit.me/auth/v2/organizations/me/{org_id}/applications/{app_id}/")
http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true
request = Net::HTTP::Patch.new(url)
request["Authorization"] = 'Bearer <token>'
request["Content-Type"] = 'application/json'
request.body = "{\n \"name\": \"Acme Production App\",\n \"website_url\": \"https://app.acme.example\"\n}"
response = http.request(request)
puts response.read_body{
"uuid": "b2c3d4e5-6789-01bc-defg-222222222222",
"name": "Acme Production App",
"client_id": "S9LIYGSoWNuGMLHsvEt9dQ",
"api_key": "05mHcOWL8GathLZlz8oIDawYj9qFAcoSHtz-75PAkuo",
"website_url": "https://app.acme.example",
"redirect_uris": [
"https://acme.example/callback"
],
"terms_url": "https://acme.example/terms",
"privacy_url": "https://acme.example/privacy",
"description": null,
"created_at": "2025-06-01T10:00:00Z"
}{
"website_url": [
"Enter a valid URL."
]
}{
"detail": "Invalid access token"
}{
"detail": "You do not have permission to perform this action."
}{
"detail": "Not found."
}Update Application
Update application metadata (name, URLs, redirect URIs). api_key and client_id are never rotated. Requires owner/admin JWT.
curl -X PATCH "https://apx.didit.me/auth/v2/organizations/me/$ORG_ID/applications/$APP_ID/" \
-H "Authorization: Bearer $ACCESS_TOKEN" \
-H "Content-Type: application/json" \
-d '{
"name": "Acme Production App",
"website_url": "https://app.acme.example"
}'import requests
resp = requests.patch(
f"https://apx.didit.me/auth/v2/organizations/me/{org_id}/applications/{app_id}/",
headers={"Authorization": f"Bearer {access_token}"},
json={
"name": "Acme Production App",
"website_url": "https://app.acme.example",
},
timeout=10,
)
resp.raise_for_status()
updated = resp.json()const resp = await fetch(
`https://apx.didit.me/auth/v2/organizations/me/${orgId}/applications/${appId}/`,
{
method: "PATCH",
headers: {
Authorization: `Bearer ${accessToken}`,
"Content-Type": "application/json",
},
body: JSON.stringify({
name: "Acme Production App",
website_url: "https://app.acme.example",
}),
},
);
if (!resp.ok) throw new Error(`Update app failed: ${resp.status}`);
const updated = await resp.json();<?php
$curl = curl_init();
curl_setopt_array($curl, [
CURLOPT_URL => "https://apx.didit.me/auth/v2/organizations/me/{org_id}/applications/{app_id}/",
CURLOPT_RETURNTRANSFER => true,
CURLOPT_ENCODING => "",
CURLOPT_MAXREDIRS => 10,
CURLOPT_TIMEOUT => 30,
CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
CURLOPT_CUSTOMREQUEST => "PATCH",
CURLOPT_POSTFIELDS => json_encode([
'name' => 'Acme Production App',
'website_url' => 'https://app.acme.example'
]),
CURLOPT_HTTPHEADER => [
"Authorization: Bearer <token>",
"Content-Type: application/json"
],
]);
$response = curl_exec($curl);
$err = curl_error($curl);
curl_close($curl);
if ($err) {
echo "cURL Error #:" . $err;
} else {
echo $response;
}package main
import (
"fmt"
"strings"
"net/http"
"io"
)
func main() {
url := "https://apx.didit.me/auth/v2/organizations/me/{org_id}/applications/{app_id}/"
payload := strings.NewReader("{\n \"name\": \"Acme Production App\",\n \"website_url\": \"https://app.acme.example\"\n}")
req, _ := http.NewRequest("PATCH", url, payload)
req.Header.Add("Authorization", "Bearer <token>")
req.Header.Add("Content-Type", "application/json")
res, _ := http.DefaultClient.Do(req)
defer res.Body.Close()
body, _ := io.ReadAll(res.Body)
fmt.Println(string(body))
}HttpResponse<String> response = Unirest.patch("https://apx.didit.me/auth/v2/organizations/me/{org_id}/applications/{app_id}/")
.header("Authorization", "Bearer <token>")
.header("Content-Type", "application/json")
.body("{\n \"name\": \"Acme Production App\",\n \"website_url\": \"https://app.acme.example\"\n}")
.asString();require 'uri'
require 'net/http'
url = URI("https://apx.didit.me/auth/v2/organizations/me/{org_id}/applications/{app_id}/")
http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true
request = Net::HTTP::Patch.new(url)
request["Authorization"] = 'Bearer <token>'
request["Content-Type"] = 'application/json'
request.body = "{\n \"name\": \"Acme Production App\",\n \"website_url\": \"https://app.acme.example\"\n}"
response = http.request(request)
puts response.read_body{
"uuid": "b2c3d4e5-6789-01bc-defg-222222222222",
"name": "Acme Production App",
"client_id": "S9LIYGSoWNuGMLHsvEt9dQ",
"api_key": "05mHcOWL8GathLZlz8oIDawYj9qFAcoSHtz-75PAkuo",
"website_url": "https://app.acme.example",
"redirect_uris": [
"https://acme.example/callback"
],
"terms_url": "https://acme.example/terms",
"privacy_url": "https://acme.example/privacy",
"description": null,
"created_at": "2025-06-01T10:00:00Z"
}{
"website_url": [
"Enter a valid URL."
]
}{
"detail": "Invalid access token"
}{
"detail": "You do not have permission to perform this action."
}{
"detail": "Not found."
}api_key stays the same unless you rotate credentials separately.Authorizations
RS256-signed JWT access_token returned by POST /programmatic/login/ or POST /programmatic/verify-email/. Send as Authorization: Bearer <access_token>. Default lifetime is 86400 seconds (24h). This token is only valid against the Account Management endpoints on apx.didit.me/auth/v2. The verification API (verification.didit.me/v3) uses the long-lived api_key as x-api-key instead.
Path Parameters
UUID of the organization that owns the application.
"a1b2c3d4-5678-90ab-cdef-111111111111"
UUID of the application to update.
"b2c3d4e5-6789-01bc-defg-222222222222"
Body
Send only the fields you want to change. PATCH semantics: missing fields are preserved.
PATCH body for application metadata. Send only the fields you want to change; omitted fields are preserved. uuid, client_id, and api_key cannot be updated.
Application display name.
"Acme Production App"
Website or app URL associated with this application.
"https://app.acme.example"
Allowed redirect URIs for OAuth-style and verification redirect flows.
["https://acme.example/callback"]
Terms of service URL shown in the verification flow.
Privacy policy URL shown in the verification flow.
Internal description for the application.
Response
Application updated. The response is the full application record after the change; uuid, client_id, and api_key are unchanged.
Full application record. uuid, client_id, and api_key never change after creation.
Application UUID. Use as {app_id} in subsequent calls.
"b2c3d4e5-6789-01bc-defg-222222222222"
Application display name shown in the Didit console.
"Acme Production App"
Public client identifier, safe to embed in OAuth-style flows.
"S9LIYGSoWNuGMLHsvEt9dQ"
Long-lived secret (also called client_secret). Use as the x-api-key header for every call to https://verification.didit.me/v3/... (sessions, workflows, AML, etc.). Treat as a credential; never expose client-side.
"05mHcOWL8GathLZlz8oIDawYj9qFAcoSHtz-75PAkuo"
Website or app URL associated with this application.
"https://acme.example"
Allowed redirect URIs for OAuth-style and verification redirect flows.
["https://acme.example/callback"]
Terms of service URL shown in the verification flow.
"https://acme.example/terms"
Privacy policy URL shown in the verification flow.
"https://acme.example/privacy"
Internal description for the application (not shown to end users).
"2025-06-01T10:00:00Z"