Change a widget embed's allowed origins
Rename a deployment or replace the website origins allowed to host it. The assistant is fixed: to serve a different one, create a new embed and revoke this one.
PATCH
Only
name and allowed_origins can change. The embedded assistant is fixed: there is no field for it. To serve a different assistant, create a new deployment and revoke this one.
Send at least one field. An omitted field, or one sent as null, is left unchanged. allowed_origins replaces the stored list rather than merging with it, so to remove an origin, send the full list you want to keep. The new list takes effect on the next widget request.
Names are unique within your organization: renaming to a name another deployment already uses returns 409 conflict. A deployment that does not exist, a deployment in another organization and a malformed ID all return the same 404.
You need the assistant.publish permission, which the owner, admin and editor roles hold. Authenticate with an arukz_sk_ API key or a signed-in console session.
string
required
The deployment’s ID (UUID), as returned in
id.string
A new label. Leading and trailing whitespace is trimmed; the result must be 1 to 120 characters,
with no control, invisible formatting (such as zero-width or bidirectional-override), private-use
or line-separator characters.
string[]
The complete new list of origins allowed to host the widget, at most 20. Each entry must be
exactly
scheme://host or scheme://host:port, with an http or https scheme, an ASCII host,
no wildcard and no trailing slash, path, query or credentials. Matching is exact; scheme and host
are compared case-insensitively and a default port is ignored. Send [] to stop the widget
loading anywhere.Response
Returns200 OK with the updated deployment.
string
required
The deployment’s ID (UUID).
string
required
The embed’s label.
string
required
The public widget key. Unchanged by an update.
string
required
The embedded assistant’s ID. Unchanged by an update.
string
required
active, revoked or expired. expired means the current time is past expires_at; an
expired embed answers nothing. A revoked embed reads revoked even after its expiry.string[]
required
Origins allowed to host the widget, de-duplicated and sorted.
string
required
When the deployment was created, ISO 8601 in UTC.
string | null
required
ID of the user who created it, or
null when it was created with an API key.string | null
required
When the embed expires, or
null if it does not.string | null
required
When the embed was revoked, or
null.string | null
required
When the widget key last authenticated a request, or
null if never.Last modified on September 26, 2026