> ## Documentation Index
> Fetch the complete documentation index at: https://docs.mithunai.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Change a widget embed's allowed origins

> Rename a deployment or replace the website origins allowed to host it. The assistant is fixed: to serve a different one, create a new embed and revoke this one.

Only `name` and `allowed_origins` can change. The embedded assistant is fixed: there is no field for it. To serve a different assistant, create a new deployment and revoke this one.

Send at least one field. An omitted field, or one sent as `null`, is left unchanged. `allowed_origins` **replaces** the stored list rather than merging with it, so to remove an origin, send the full list you want to keep. The new list takes effect on the next widget request.

Names are unique within your organization: renaming to a name another deployment already uses returns `409 conflict`. A deployment that does not exist, a deployment in another organization and a malformed ID all return the same `404`.

You need the `assistant.publish` permission, which the owner, admin and editor roles hold. Authenticate with an `arukz_sk_` API key or a signed-in console session.

<ParamField path="deployment_id" type="string" required>
  The deployment's ID (UUID), as returned in `id`.
</ParamField>

<ParamField body="name" type="string">
  A new label. Leading and trailing whitespace is trimmed; the result must be 1 to 120 characters,
  with no control, invisible formatting (such as zero-width or bidirectional-override), private-use
  or line-separator characters.
</ParamField>

<ParamField body="allowed_origins" type="string[]">
  The complete new list of origins allowed to host the widget, at most 20. Each entry must be
  exactly `scheme://host` or `scheme://host:port`, with an `http` or `https` scheme, an ASCII host,
  no wildcard and no trailing slash, path, query or credentials. Matching is exact; scheme and host
  are compared case-insensitively and a default port is ignored. Send `[]` to stop the widget
  loading anywhere.
</ParamField>

## Response

Returns `200 OK` with the updated deployment.

<ResponseField name="id" type="string" required>
  The deployment's ID (UUID).
</ResponseField>

<ResponseField name="name" type="string" required>
  The embed's label.
</ResponseField>

<ResponseField name="widget_key" type="string" required>
  The public widget key. Unchanged by an update.
</ResponseField>

<ResponseField name="assistant_id" type="string" required>
  The embedded assistant's ID. Unchanged by an update.
</ResponseField>

<ResponseField name="status" type="string" required>
  `active`, `revoked` or `expired`. `expired` means the current time is past `expires_at`; an
  expired embed answers nothing. A revoked embed reads `revoked` even after its expiry.
</ResponseField>

<ResponseField name="allowed_origins" type="string[]" required>
  Origins allowed to host the widget, de-duplicated and sorted.
</ResponseField>

<ResponseField name="created_at" type="string" required>
  When the deployment was created, ISO 8601 in UTC.
</ResponseField>

<ResponseField name="created_by" type="string | null" required>
  ID of the user who created it, or `null` when it was created with an API key.
</ResponseField>

<ResponseField name="expires_at" type="string | null" required>
  When the embed expires, or `null` if it does not.
</ResponseField>

<ResponseField name="revoked_at" type="string | null" required>
  When the embed was revoked, or `null`.
</ResponseField>

<ResponseField name="last_used_at" type="string | null" required>
  When the widget key last authenticated a request, or `null` if never.
</ResponseField>

<RequestExample>
  ```bash cURL theme={"theme":{"light":"github-light","dark":"github-dark"}}
  curl --request PATCH "$MITHUNAI_URL/arukz/api/v1/widget-deployments/8d0f5a2e-3c41-4b7a-9e6d-1f2a3b4c5d6e" \
    --header "Authorization: Bearer $MITHUNAI_API_KEY" \
    --header "Content-Type: application/json" \
    --data '{"allowed_origins": ["https://docs.example.com", "https://help.example.com"]}'
  ```

  ```python Python theme={"theme":{"light":"github-light","dark":"github-dark"}}
  import os, requests

  deployment_id = "8d0f5a2e-3c41-4b7a-9e6d-1f2a3b4c5d6e"
  response = requests.patch(
      f"{os.environ['MITHUNAI_URL']}/arukz/api/v1/widget-deployments/{deployment_id}",
      headers={"Authorization": f"Bearer {os.environ['MITHUNAI_API_KEY']}"},
      json={"allowed_origins": ["https://docs.example.com", "https://help.example.com"]},
      timeout=30,
  )
  response.raise_for_status()
  print(response.json()["allowed_origins"])
  ```

  ```javascript JavaScript theme={"theme":{"light":"github-light","dark":"github-dark"}}
  const deploymentId = '8d0f5a2e-3c41-4b7a-9e6d-1f2a3b4c5d6e'
  const response = await fetch(
    `${process.env.MITHUNAI_URL}/arukz/api/v1/widget-deployments/${deploymentId}`,
    {
      method: 'PATCH',
      headers: {
        Authorization: `Bearer ${process.env.MITHUNAI_API_KEY}`,
        'Content-Type': 'application/json',
      },
      body: JSON.stringify({
        allowed_origins: ['https://docs.example.com', 'https://help.example.com'],
      }),
    },
  )
  console.log(await response.json())
  ```
</RequestExample>

<ResponseExample>
  ```json 200 theme={"theme":{"light":"github-light","dark":"github-dark"}}
  {
    "id": "8d0f5a2e-3c41-4b7a-9e6d-1f2a3b4c5d6e",
    "name": "Docs site widget",
    "widget_key": "arukz_wk_8d0f5a2e-3c41-4b7a-9e6d-1f2a3b4c5d6e",
    "assistant_id": "5b1e9c2a-7d4f-4e3b-9a61-0c8f2d7e4a13",
    "status": "active",
    "allowed_origins": ["https://docs.example.com", "https://help.example.com"],
    "created_at": "2026-09-20T14:03:11.482190+00:00",
    "created_by": "7c9e6679-7425-40de-944b-e07fc1f90ae7",
    "expires_at": null,
    "revoked_at": null,
    "last_used_at": "2026-09-24T07:58:30.021455+00:00"
  }
  ```

  ```json 400 theme={"theme":{"light":"github-light","dark":"github-dark"}}
  { "code": "validation_error", "message": "An update must change something." }
  ```

  ```json 401 theme={"theme":{"light":"github-light","dark":"github-dark"}}
  { "code": "authentication_error", "message": "Authentication is required." }
  ```

  ```json 403 theme={"theme":{"light":"github-light","dark":"github-dark"}}
  { "code": "authorization_error", "message": "You do not have permission to perform this action." }
  ```

  ```json 409 theme={"theme":{"light":"github-light","dark":"github-dark"}}
  { "code": "conflict", "message": "A widget deployment with that name already exists." }
  ```

  ```json 404 theme={"theme":{"light":"github-light","dark":"github-dark"}}
  { "code": "not_found", "message": "The requested resource was not found." }
  ```
</ResponseExample>