Change an app
update_appDestructive
Change a saved app: its name, scenarios, limits, notes, test logins, store password, allowed origins. Only the fields you pass change; "" clears a field (for store_password: removes the stored one). test_email/test_password set or replace the default test user; test_accounts adds or updates named ones by label; remove_test_accounts deletes test accounts by label, "default" included. Passwords are write-only: stored encrypted, never returned (list_apps says has_password). When a verdict says a sign-in or the store password failed, set it here.
Tool call template
Replace each placeholder with a value matching the input schema. Only required parameters are included; add optional parameters as needed.
{
"id": 1,
"jsonrpc": "2.0",
"method": "tools/call",
"params": {
"arguments": {
"app_id": "<app_id>"
},
"name": "update_app"
}
}Input Schema
| Name | Required | Description | Default |
|---|---|---|---|
| name | No | What the team calls the app, shown instead of its address (at most 60 characters); "" clears it | |
| team | No | Act in another of your teams, by its name or id (whoami lists them). Omitted: the key's own team | |
| notes | No | Replaces the notes; "" clears them | |
| app_id | Yes | App id from list_apps or create_app | |
| limits | No | The rules of what a check may never do, one per line (list_apps has them as `rules`). A new line adds a rule. Every rule already in place must be in the text — only a person removes a rule, on the app's Rules tab; a text that leaves one out changes nothing | |
| resume | No | true resumes a paused app | |
| worries | No | What worries the person most about this app, in their words, shown first on the Rules tab; every check answers it in the verdict's first line. "" clears it | |
| scenarios | No | Adds scenarios, one per line (or one per sentence), each watched from the next check; one the app already has is kept as it is. Only a person stops watching one, on the app's Journeys tab. "" clears the app's older free-text scenarios | |
| merge_gate | No | What fails the commit's CheckMyApp check on GitHub: critical (default — a Broken verdict or a critical journey that did not hold), new_p0_p1 (a P0/P1 finding new on this build), none (never — it only informs) | |
| test_email | No | The default test user's sign-in email | |
| webhook_url | No | An https address that receives each check of a watched app as JSON, signed once a person sets the secret on the app's Rules tab; "" removes it | |
| test_records | No | "never" stops checks creating test records on the live app. Only a person allows them, on the app's Rules tab | |
| pause_because | No | Pauses every check that runs by itself, deploys included. Pass what the person said, word for word; it is shown beside the pause. Pause only when they asked. A check you start still runs | |
| session_login | No | Website apps only. A session login: one more login of the app, under this label ("" = "session") — the person whose sign-in the app uses signs in once, as the app's test user (Google, a magic link, anything), in their own browser on the app's sign-in page in CheckMyApp. A scenario uses it when it names it (add_scenario login); a check uses it for everything only when the app has no other login. A label renames it; null removes it | |
| test_accounts | No | Adds each named test user, or updates the one already stored under that label. Others are kept | |
| test_password | No | The default test user's password; sets or replaces the stored one. Write-only: stored encrypted, never returned (list_apps says has_password) | |
| way_in_needed | No | Undoes way_in_not_needed: the next check asks for this way in again | |
| store_password | No | New store password of a password-protected store. Stored encrypted and never returned; "" removes it | |
| allowed_origins | No | Replaces the app's allowed origins; [] clears them | |
| test_totp_secret | No | For a login whose app asks for a code from an authenticator app: the secret shown under the QR code when 2FA was set up, or the otpauth:// address in it. The check types {{TEST_TOTP}} codes from it. Write-only (list_apps says has_authenticator); "" removes it | |
| slack_webhook_url | No | The Slack incoming webhook this app's breaks and fixes post to, https://hooks.slack.com/…; "" removes it | |
| way_in_not_needed | No | A provider from list_apps offered_ways_in, when the person said its test users never sign in that way. Checks stop asking for it | |
| remove_test_accounts | No | Labels of test accounts to delete, "default" included (its email and password) |