Change a widget embed's allowed origins
Rename a widget deployment or replace the origins allowed to host it. The assistant is fixed: to serve another, create a new embed instead.
PATCH
/
widget-deployments
/
{deployment_id}
curl --request PATCH "$MITHUNAI_URL/mithunai/api/v1/widget-deployments/8d0f5a2e-3c41-4b7a-9e6d-1f2a3b4c5d6e" \
--header "Authorization: Bearer $MITHUNAI_API_KEY" \
--header "Content-Type: application/json" \
--data '{"allowed_origins": ["https://docs.example.com", "https://help.example.com"]}'
import os, requests
deployment_id = "8d0f5a2e-3c41-4b7a-9e6d-1f2a3b4c5d6e"
response = requests.patch(
f"{os.environ['MITHUNAI_URL']}/mithunai/api/v1/widget-deployments/{deployment_id}",
headers={"Authorization": f"Bearer {os.environ['MITHUNAI_API_KEY']}"},
json={"allowed_origins": ["https://docs.example.com", "https://help.example.com"]},
timeout=30,
)
response.raise_for_status()
print(response.json()["allowed_origins"])
const deploymentId = '8d0f5a2e-3c41-4b7a-9e6d-1f2a3b4c5d6e'
const response = await fetch(
`${process.env.MITHUNAI_URL}/mithunai/api/v1/widget-deployments/${deploymentId}`,
{
method: 'PATCH',
headers: {
Authorization: `Bearer ${process.env.MITHUNAI_API_KEY}`,
'Content-Type': 'application/json',
},
body: JSON.stringify({
allowed_origins: ['https://docs.example.com', 'https://help.example.com'],
}),
},
)
console.log(await response.json())
{
"id": "8d0f5a2e-3c41-4b7a-9e6d-1f2a3b4c5d6e",
"name": "Docs site widget",
"widget_key": "mithunai_wk_8d0f5a2e-3c41-4b7a-9e6d-1f2a3b4c5d6e",
"assistant_id": "5b1e9c2a-7d4f-4e3b-9a61-0c8f2d7e4a13",
"status": "active",
"allowed_origins": ["https://docs.example.com", "https://help.example.com"],
"created_at": "2026-09-20T14:03:11.482190+00:00",
"created_by": "7c9e6679-7425-40de-944b-e07fc1f90ae7",
"expires_at": null,
"revoked_at": null,
"last_used_at": "2026-09-24T07:58:30.021455+00:00"
}
{ "code": "validation_error", "message": "An update must change something." }
{ "code": "authentication_error", "message": "Authentication is required." }
{ "code": "authorization_error", "message": "You do not have permission to perform this action." }
{ "code": "conflict", "message": "A widget deployment with that name already exists." }
{ "code": "not_found", "message": "The requested resource was not found." }
Only
name, allowed_origins and presentation can change. The embedded assistant is fixed: there is no field for it. To serve a different assistant, create a new deployment and revoke this one.
Send at least one field. An omitted field, or one sent as null, is left unchanged. allowed_origins replaces the stored list rather than merging with it, so to remove an origin, send the full list you want to keep. The new list takes effect on the next widget request.
Names are unique within your organization: renaming to a name another deployment already uses returns 409 conflict. A deployment that does not exist, a deployment in another organization and a malformed ID all return the same 404.
You need the assistant.publish permission, which the owner, admin and editor roles hold. Authenticate with an mithunai_sk_ API key or a signed-in console session.
string
required
The deployment’s ID (UUID), as returned in
id.string
A new label. Leading and trailing whitespace is trimmed; the result must be 1 to 120 characters,
with no control, invisible formatting (such as zero-width or bidirectional-override), private-use
or line-separator characters.
string[]
The complete new list of origins allowed to host the widget, at most 20. Each entry must be
exactly
scheme://host or scheme://host:port, with an http or https scheme, an ASCII host,
no wildcard and no trailing slash, path, query or credentials. Matching is exact; scheme and host
are compared case-insensitively and a default port is ignored. Send [] to stop the widget
loading anywhere.string | null
How the widget appears on a page whose snippet has no
data-mode: chat, sidebar, search or
deflector. Unlike the other fields, null here clears the stored value; omit the field to
leave it. Refused with 400 while stored presentations are off on your deployment.Response
Returns200 OK with the updated deployment.
string
required
The deployment’s ID (UUID).
string
required
The embed’s label.
string
required
The public widget key. Unchanged by an update.
string
required
The embedded assistant’s ID. Unchanged by an update.
string
required
active, revoked or expired. expired means the current time is past expires_at; an
expired embed answers nothing. A revoked embed reads revoked even after its expiry.string[]
required
Origins allowed to host the widget, de-duplicated and sorted.
string
required
When the deployment was created, ISO 8601 in UTC.
string | null
required
ID of the user who created it, or
null when it was created with an API key.string | null
required
When the embed expires, or
null if it does not.string | null
required
When the embed was revoked, or
null.string | null
required
When the widget key last authenticated a request, or
null if never.string | null
required
How the widget appears on a page whose snippet has no
data-mode: chat, sidebar, search or
deflector, or null (the snippet decides). Always null while stored presentations are off on
your deployment. See Setting the default for an
embed.curl --request PATCH "$MITHUNAI_URL/mithunai/api/v1/widget-deployments/8d0f5a2e-3c41-4b7a-9e6d-1f2a3b4c5d6e" \
--header "Authorization: Bearer $MITHUNAI_API_KEY" \
--header "Content-Type: application/json" \
--data '{"allowed_origins": ["https://docs.example.com", "https://help.example.com"]}'
import os, requests
deployment_id = "8d0f5a2e-3c41-4b7a-9e6d-1f2a3b4c5d6e"
response = requests.patch(
f"{os.environ['MITHUNAI_URL']}/mithunai/api/v1/widget-deployments/{deployment_id}",
headers={"Authorization": f"Bearer {os.environ['MITHUNAI_API_KEY']}"},
json={"allowed_origins": ["https://docs.example.com", "https://help.example.com"]},
timeout=30,
)
response.raise_for_status()
print(response.json()["allowed_origins"])
const deploymentId = '8d0f5a2e-3c41-4b7a-9e6d-1f2a3b4c5d6e'
const response = await fetch(
`${process.env.MITHUNAI_URL}/mithunai/api/v1/widget-deployments/${deploymentId}`,
{
method: 'PATCH',
headers: {
Authorization: `Bearer ${process.env.MITHUNAI_API_KEY}`,
'Content-Type': 'application/json',
},
body: JSON.stringify({
allowed_origins: ['https://docs.example.com', 'https://help.example.com'],
}),
},
)
console.log(await response.json())
{
"id": "8d0f5a2e-3c41-4b7a-9e6d-1f2a3b4c5d6e",
"name": "Docs site widget",
"widget_key": "mithunai_wk_8d0f5a2e-3c41-4b7a-9e6d-1f2a3b4c5d6e",
"assistant_id": "5b1e9c2a-7d4f-4e3b-9a61-0c8f2d7e4a13",
"status": "active",
"allowed_origins": ["https://docs.example.com", "https://help.example.com"],
"created_at": "2026-09-20T14:03:11.482190+00:00",
"created_by": "7c9e6679-7425-40de-944b-e07fc1f90ae7",
"expires_at": null,
"revoked_at": null,
"last_used_at": "2026-09-24T07:58:30.021455+00:00"
}
{ "code": "validation_error", "message": "An update must change something." }
{ "code": "authentication_error", "message": "Authentication is required." }
{ "code": "authorization_error", "message": "You do not have permission to perform this action." }
{ "code": "conflict", "message": "A widget deployment with that name already exists." }
{ "code": "not_found", "message": "The requested resource was not found." }
Last modified on November 11, 2026
curl --request PATCH "$MITHUNAI_URL/mithunai/api/v1/widget-deployments/8d0f5a2e-3c41-4b7a-9e6d-1f2a3b4c5d6e" \
--header "Authorization: Bearer $MITHUNAI_API_KEY" \
--header "Content-Type: application/json" \
--data '{"allowed_origins": ["https://docs.example.com", "https://help.example.com"]}'
import os, requests
deployment_id = "8d0f5a2e-3c41-4b7a-9e6d-1f2a3b4c5d6e"
response = requests.patch(
f"{os.environ['MITHUNAI_URL']}/mithunai/api/v1/widget-deployments/{deployment_id}",
headers={"Authorization": f"Bearer {os.environ['MITHUNAI_API_KEY']}"},
json={"allowed_origins": ["https://docs.example.com", "https://help.example.com"]},
timeout=30,
)
response.raise_for_status()
print(response.json()["allowed_origins"])
const deploymentId = '8d0f5a2e-3c41-4b7a-9e6d-1f2a3b4c5d6e'
const response = await fetch(
`${process.env.MITHUNAI_URL}/mithunai/api/v1/widget-deployments/${deploymentId}`,
{
method: 'PATCH',
headers: {
Authorization: `Bearer ${process.env.MITHUNAI_API_KEY}`,
'Content-Type': 'application/json',
},
body: JSON.stringify({
allowed_origins: ['https://docs.example.com', 'https://help.example.com'],
}),
},
)
console.log(await response.json())
{
"id": "8d0f5a2e-3c41-4b7a-9e6d-1f2a3b4c5d6e",
"name": "Docs site widget",
"widget_key": "mithunai_wk_8d0f5a2e-3c41-4b7a-9e6d-1f2a3b4c5d6e",
"assistant_id": "5b1e9c2a-7d4f-4e3b-9a61-0c8f2d7e4a13",
"status": "active",
"allowed_origins": ["https://docs.example.com", "https://help.example.com"],
"created_at": "2026-09-20T14:03:11.482190+00:00",
"created_by": "7c9e6679-7425-40de-944b-e07fc1f90ae7",
"expires_at": null,
"revoked_at": null,
"last_used_at": "2026-09-24T07:58:30.021455+00:00"
}
{ "code": "validation_error", "message": "An update must change something." }
{ "code": "authentication_error", "message": "Authentication is required." }
{ "code": "authorization_error", "message": "You do not have permission to perform this action." }
{ "code": "conflict", "message": "A widget deployment with that name already exists." }
{ "code": "not_found", "message": "The requested resource was not found." }