> ## Documentation Index > Fetch the complete documentation index at: https://docs.flowra.dev/llms.txt > Use this file to discover all available pages before exploring further. # Update an existing toolkit > Update a toolkit’s name, slug, or other settings. Only the fields you send are changed. ## OpenAPI ````yaml /api-reference/openapi.json patch /api/v1/toolkits/byId/{id} openapi: 3.0.0 info: title: Flowra API (API Key Endpoints) description: >- **Flowra** is an AI-powered platform for building agents, workflows, and integrations. ### Capabilities - **Tools & Toolkits** – Define and group tools for agents and workflows. - **Workflows** – Orchestrate steps and automate processes. - **Triggers** – Schedule or event-based execution. - **Auth & Connections** – OAuth, API keys, and connected accounts. - **MCP** – Model Context Protocol server integration. - **Knowledge / RAG** – Add files and URLs for retrieval-augmented generation. ### Authentication Use the **x-api-key** header with a project API key to access endpoints that support API Key auth. Create and manage API keys in the dashboard under your project settings. Only endpoints that support API Key authentication via the @ApiKeyEnabled() decorator. Send x-api-key (required). On multi-tenant endpoints, optionally send x-username to act as an external user. version: '1.0' contact: name: Flowra url: https://flowra.dev servers: - url: https://flowra.dev description: Flowra API security: [] tags: - name: Users description: User profile - name: External Users description: End-user identities inside a project (x-username) - name: Auth Configs description: OAuth and API key configs for toolkits - name: Connected Accounts description: OAuth connected accounts and link creation - name: Toolkits description: List and search toolkits - name: Tools description: List, execute, and manage tools - name: Skills description: Browse, create, import, and install skills - name: Workflow & Agent description: Create, run, and inspect workflows and agents - name: Triggers description: Schedule and event-based trigger instances - name: Chat description: Threads and streaming agent runs - name: File description: Upload, list, and download files - name: Knowledge description: RAG knowledge collections - name: Table description: Collections and documents - name: Sandbox description: Ephemeral and durable code sandboxes - name: Browser description: Live browser sessions and view - name: LLM description: List AI models and generate completions - name: MCP description: MCP server management - name: usage description: Credit balance and usage ledger for the project API key paths: /api/v1/toolkits/byId/{id}: patch: tags: - Toolkits summary: Update an existing toolkit description: >- Update a toolkit’s name, slug, or other settings. Only the fields you send are changed. operationId: ToolkitsController_updateToolkit parameters: - name: id required: true in: path schema: type: string requestBody: required: true content: application/json: schema: $ref: '#/components/schemas/UpdateToolkitDto' responses: '200': description: Toolkit updated successfully content: application/json: schema: $ref: '#/components/schemas/ToolkitSuccessResponse' example: success: true message: Operation completed successfully data: id: '' createdAt: '' updatedAt: '' deletedAt: '2024-01-01T00:00:00.000Z' slug: '' name: '' description: '' logo: '' appUrl: '' authSchemes: - '' providerManagedAuthSchemes: - '' noAuth: true isDisabled: true version: '' authConfigDetails: - name: oauth2 mode: OAUTH2 fields: authConfigCreation: {} connectedAccountInitiation: {} proxy: baseUrl: '' deprecatedAuthProviderDetails: authorization_url: '' token_url: '' authFlow: static_secret authRecipe: {} popularityScore: 0 baseUrl: '' getCurrentUserEndpoint: '' provider: COMPOSIO project: id: '' publicId: '' apiKeys: - id: '' key: '' name: '' description: '' project: {} projectId: '' isActive: true expiresAt: '2024-01-01T00:00:00.000Z' lastUsedAt: '2024-01-01T00:00:00.000Z' permissions: - '' createdAt: '2024-01-01T00:00:00.000Z' updatedAt: '2024-01-01T00:00:00.000Z' name: '' description: '' userId: '' user: id: '' email: '' password: '' socialAccounts: - {} firstName: '' lastName: '' roles: - {} sessions: - {} projects: - {} isActive: true tokenVersion: 0 createdAt: '2024-01-01T00:00:00.000Z' updatedAt: '2024-01-01T00:00:00.000Z' isActive: true triggerWebhookUrl: '' webhookSecret: '' identityHmacSecret: '' identityJwt: alg: {} secret: '' jwksUrl: '' issuer: '' audience: '' application: logo: '' title: '' apiKeysOverride: OPENROUTER_API_KEY: '' allowEndUserWorkflows: true allowEndUserDatabaseCollections: true allowEndUserKnowledgeCollections: true region: '' createdAt: '2024-01-01T00:00:00.000Z' updatedAt: '2024-01-01T00:00:00.000Z' projectId: '' seatBilled: true regions: - '' categories: - '' seo: {} activeStatus: true security: - x-api-key: [] components: schemas: UpdateToolkitDto: type: object properties: slug: type: string minLength: 3 maxLength: 100 description: >- Toolkit slug (admin only on update; remaps linked tools and auth rows). Non-admins cannot change slug. example: my-custom-toolkit provider: enum: - COMPOSIO - LOCAL type: string description: Toolkit provider (admin only) name: type: string maxLength: 200 description: Toolkit display name example: Updated Toolkit Name description: type: string description: Toolkit description example: Updated description logo: type: string pattern: /^(https?:\/\/\S+|file:[0-9a-fA-F-]{36}|\/public\/\S+)$/ description: >- Logo: https URL, /public/... (global), or file: (project upload) example: https://example.com/new-logo.png appUrl: type: string description: Application URL example: https://new-app.example.com authSchemes: description: Authentication schemes example: - OAUTH2 - API_KEY type: array items: type: string providerManagedAuthSchemes: description: Provider-managed authentication schemes (e.g. Local or Composio) example: - OAUTH2 type: array items: type: string noAuth: type: boolean description: Whether this toolkit requires no authentication example: false isDisabled: type: boolean description: Whether toolkit is disabled example: false version: type: string description: Toolkit version example: 1.1.0 popularityScore: type: number minimum: 0 description: Popularity score (ordering / ranking) example: 0 categories: type: array enum: - developer-tools-&-devops - collaboration-&-communication - ai-&-machine-learning - document-&-file-management - productivity-&-project-management - crm - analytics-&-data - entertainment-&-media - education-&-lms - design-&-creative-tools - marketing-&-social-media - scheduling-&-booking - e-commerce - finance-&-accounting - sales-&-customer-support - hr-&-recruiting - social-media - workflow-automation - data-&-analytics - advertising-&-marketing description: Curated toolkit category ids example: - crm - sales-&-customer-support items: type: string enum: - developer-tools-&-devops - collaboration-&-communication - ai-&-machine-learning - document-&-file-management - productivity-&-project-management - crm - analytics-&-data - entertainment-&-media - education-&-lms - design-&-creative-tools - marketing-&-social-media - scheduling-&-booking - e-commerce - finance-&-accounting - sales-&-customer-support - hr-&-recruiting - social-media - workflow-automation - data-&-analytics - advertising-&-marketing baseUrl: type: string description: Base URL example: https://api.example.com getCurrentUserEndpoint: type: string description: Path for resolving current user (e.g. /api/me) example: /api/me authConfigDetails: description: Auth config details type: array items: $ref: '#/components/schemas/AuthConfigDetailsDto' authFlow: enum: - static_secret - cookie_paste - password - password_otp - oauth - whatsapp_qr - zernio_connect type: string description: How end users connect authRecipe: $ref: '#/components/schemas/ToolkitAuthRecipeDto' regions: nullable: true description: >- ISO 3166-1 alpha-2 region codes this toolkit is available in. Empty array or null = global. example: - IR - US type: array items: type: string ToolkitSuccessResponse: type: object properties: success: type: boolean description: Success status example: true message: type: string description: Success message example: Operation completed successfully data: type: object properties: id: type: string createdAt: type: string updatedAt: type: string deletedAt: format: date-time type: string slug: type: string name: type: string description: type: string logo: type: string appUrl: type: string authSchemes: type: array items: type: string providerManagedAuthSchemes: type: array items: type: string noAuth: type: boolean isDisabled: type: boolean version: type: string authConfigDetails: type: array items: type: object properties: name: type: string description: Auth provider name example: oauth2 mode: enum: - OAUTH1 - OAUTH2 - S2S_OAUTH2 - API_KEY - BASIC - BEARER_TOKEN - BILLCOM_AUTH - GOOGLE_SERVICE_ACCOUNT - NO_AUTH - BASIC_WITH_JWT - CALCOM_AUTH - SERVICE_ACCOUNT - SAML - DCR_OAUTH - COOKIE - WHATSAPP_QR type: string description: Authentication mode example: OAUTH2 fields: type: object properties: authConfigCreation: $ref: '#/components/schemas/AuthConfigCreationFieldsDto' connectedAccountInitiation: $ref: '#/components/schemas/AuthConfigCreationFieldsDto' required: - authConfigCreation - connectedAccountInitiation proxy: type: object properties: baseUrl: type: string description: Proxy configuration deprecatedAuthProviderDetails: type: object properties: authorization_url: type: string token_url: type: string description: Deprecated auth provider details required: - name - mode - fields authFlow: type: string nullable: true description: >- How end users authenticate for this toolkit (password, otp, cookie paste, oauth, …). When null, inferred from authSchemes / authRecipe. enum: - static_secret - cookie_paste - password - password_otp - oauth - whatsapp_qr - zernio_connect authRecipe: type: object nullable: true description: >- Declarative HTTP login/OTP steps — executed by AuthChallengeService, never as tools. popularityScore: type: number baseUrl: type: string getCurrentUserEndpoint: type: string provider: type: string enum: - COMPOSIO - LOCAL project: type: object properties: id: type: string publicId: type: string description: Public short id for URLs (stable, unique). apiKeys: type: array items: type: object properties: id: type: string key: type: string name: type: string description: type: string project: $ref: '#/components/schemas/Project' projectId: type: string isActive: type: boolean expiresAt: format: date-time type: string lastUsedAt: format: date-time type: string permissions: type: array items: type: string createdAt: format: date-time type: string updatedAt: format: date-time type: string required: - id - key - name - description - project - projectId - isActive - expiresAt - lastUsedAt - permissions - createdAt - updatedAt name: type: string description: type: string userId: type: string user: type: object properties: id: type: string email: type: string password: type: string description: >- Never loaded unless a query asks for it explicitly (`addSelect('user.password')`). `LoadUserInterceptor` puts the full entity on `request.user`, and several endpoints return payloads built from user rows, so a selectable hash is one careless `relations: ['user']` away from being served to a client. Writes are unaffected: assigning a value and saving still persists it. socialAccounts: type: array items: $ref: '#/components/schemas/UserSocialAccount' firstName: type: string lastName: type: string roles: type: array items: $ref: '#/components/schemas/Role' sessions: type: array items: $ref: '#/components/schemas/UserSession' projects: type: array items: $ref: '#/components/schemas/Project' isActive: type: boolean tokenVersion: type: number description: >- Stamped into every access token and compared on each request, so a token can be revoked without a denylist. Logout and password reset bump it, which invalidates every token issued before that moment. createdAt: format: date-time type: string updatedAt: format: date-time type: string required: - id - email - password - socialAccounts - firstName - lastName - roles - sessions - projects - isActive - tokenVersion - createdAt - updatedAt isActive: type: boolean triggerWebhookUrl: type: string webhookSecret: type: string identityHmacSecret: type: string nullable: true description: >- HMAC secret for Intercom-style widget identity (`data-user-id` + `data-user-hash`). Never send to the browser; dashboard shows it once on rotate. identityJwt: type: object properties: alg: type: object secret: type: string nullable: true jwksUrl: type: string nullable: true issuer: type: string nullable: true audience: type: string nullable: true application: type: object properties: logo: type: string title: type: string apiKeysOverride: type: object properties: OPENROUTER_API_KEY: type: string allowEndUserWorkflows: type: boolean description: >- When true, secondary external users (eUID !== projectId) may create/update agents and workflows. Project default eUID is always allowed. Default false. allowEndUserDatabaseCollections: type: boolean description: >- When true, secondary external users may create/delete/rename database collections (meta). Row ops on delegated collections are unaffected. Default false. allowEndUserKnowledgeCollections: type: boolean description: >- When true, secondary external users may create/delete/rename knowledge collections. Search on allowlisted collections is unaffected. Default false. region: type: string nullable: true description: >- ISO 3166-1 alpha-2 project region for catalog filtering. null = global (only see toolkits/templates with empty regions). createdAt: format: date-time type: string updatedAt: format: date-time type: string required: - id - publicId - apiKeys - name - description - userId - user - isActive - triggerWebhookUrl - webhookSecret - identityHmacSecret - identityJwt - application - apiKeysOverride - allowEndUserWorkflows - allowEndUserDatabaseCollections - allowEndUserKnowledgeCollections - region - createdAt - updatedAt projectId: type: string seatBilled: type: boolean description: >- Live connected accounts for this toolkit are billed per day (not per tool call). Rates stay in the pricing seat catalog; this flag is for API/UI and seed sync. regions: nullable: true description: |- ISO 3166-1 alpha-2 country codes this toolkit is available in. null/empty = global (visible for every project region). type: array items: type: string categories: nullable: true description: |- Curated toolkit category ids (Composio allowlist). null/empty = uncategorized (still visible under "All"). type: array items: type: string seo: type: object nullable: true description: |- Public catalog SEO copy (LLM or manual). Null until filled once. Exposed only on GET /toolkits/bySlug/:slug — not list or byId. activeStatus: type: boolean required: - id - slug - name - description - logo - appUrl - authSchemes - providerManagedAuthSchemes - noAuth - isDisabled - version - authConfigDetails - authFlow - authRecipe - popularityScore - baseUrl - getCurrentUserEndpoint - provider - project - projectId - seatBilled - regions - categories example: id: '' createdAt: '' updatedAt: '' deletedAt: '2024-01-01T00:00:00.000Z' slug: '' name: '' description: '' logo: '' appUrl: '' authSchemes: - '' providerManagedAuthSchemes: - '' noAuth: true isDisabled: true version: '' authConfigDetails: - name: oauth2 mode: OAUTH2 fields: authConfigCreation: {} connectedAccountInitiation: {} proxy: baseUrl: '' deprecatedAuthProviderDetails: authorization_url: '' token_url: '' authFlow: static_secret authRecipe: {} popularityScore: 0 baseUrl: '' getCurrentUserEndpoint: '' provider: COMPOSIO project: id: '' publicId: '' apiKeys: - id: '' key: '' name: '' description: '' project: {} projectId: '' isActive: true expiresAt: '2024-01-01T00:00:00.000Z' lastUsedAt: '2024-01-01T00:00:00.000Z' permissions: - '' createdAt: '2024-01-01T00:00:00.000Z' updatedAt: '2024-01-01T00:00:00.000Z' name: '' description: '' userId: '' user: id: '' email: '' password: '' socialAccounts: - {} firstName: '' lastName: '' roles: - {} sessions: - {} projects: - {} isActive: true tokenVersion: 0 createdAt: '2024-01-01T00:00:00.000Z' updatedAt: '2024-01-01T00:00:00.000Z' isActive: true triggerWebhookUrl: '' webhookSecret: '' identityHmacSecret: '' identityJwt: alg: {} secret: '' jwksUrl: '' issuer: '' audience: '' application: logo: '' title: '' apiKeysOverride: OPENROUTER_API_KEY: '' allowEndUserWorkflows: true allowEndUserDatabaseCollections: true allowEndUserKnowledgeCollections: true region: '' createdAt: '2024-01-01T00:00:00.000Z' updatedAt: '2024-01-01T00:00:00.000Z' projectId: '' seatBilled: true regions: - '' categories: - '' seo: {} activeStatus: true required: - success - message - data AuthConfigDetailsDto: type: object properties: name: type: string description: Auth provider name example: oauth2 mode: enum: - OAUTH1 - OAUTH2 - S2S_OAUTH2 - API_KEY - BASIC - BEARER_TOKEN - BILLCOM_AUTH - GOOGLE_SERVICE_ACCOUNT - NO_AUTH - BASIC_WITH_JWT - CALCOM_AUTH - SERVICE_ACCOUNT - SAML - DCR_OAUTH - COOKIE - WHATSAPP_QR type: string description: Authentication mode example: OAUTH2 fields: $ref: '#/components/schemas/AuthConfigFieldsDto' proxy: description: Proxy configuration nullable: true allOf: - $ref: '#/components/schemas/AuthConfigProxyDto' deprecatedAuthProviderDetails: description: Deprecated auth provider details nullable: true allOf: - $ref: '#/components/schemas/DeprecatedAuthProviderDetailsDto' required: - name - mode - fields ToolkitAuthRecipeDto: type: object properties: steps: type: array items: $ref: '#/components/schemas/AuthRecipeStepDto' sessionExtract: $ref: '#/components/schemas/AuthRecipeSessionExtractDto' required: - steps AuthConfigCreationFieldsDto: type: object properties: required: description: Required fields for auth config creation type: array items: $ref: '#/components/schemas/AuthConfigFieldDto' optional: description: Optional fields for auth config creation type: array items: $ref: '#/components/schemas/AuthConfigFieldDto' required: - required - optional Project: type: object properties: id: type: string publicId: type: string description: Public short id for URLs (stable, unique). apiKeys: type: array items: $ref: '#/components/schemas/ApiKey' name: type: string description: type: string userId: type: string user: $ref: '#/components/schemas/User' isActive: type: boolean triggerWebhookUrl: type: string webhookSecret: type: string identityHmacSecret: type: string nullable: true description: >- HMAC secret for Intercom-style widget identity (`data-user-id` + `data-user-hash`). Never send to the browser; dashboard shows it once on rotate. identityJwt: type: object properties: alg: type: object secret: type: string nullable: true jwksUrl: type: string nullable: true issuer: type: string nullable: true audience: type: string nullable: true application: type: object properties: logo: type: string title: type: string apiKeysOverride: type: object properties: OPENROUTER_API_KEY: type: string allowEndUserWorkflows: type: boolean description: >- When true, secondary external users (eUID !== projectId) may create/update agents and workflows. Project default eUID is always allowed. Default false. allowEndUserDatabaseCollections: type: boolean description: >- When true, secondary external users may create/delete/rename database collections (meta). Row ops on delegated collections are unaffected. Default false. allowEndUserKnowledgeCollections: type: boolean description: >- When true, secondary external users may create/delete/rename knowledge collections. Search on allowlisted collections is unaffected. Default false. region: type: string nullable: true description: |- ISO 3166-1 alpha-2 project region for catalog filtering. null = global (only see toolkits/templates with empty regions). createdAt: format: date-time type: string updatedAt: format: date-time type: string required: - id - publicId - apiKeys - name - description - userId - user - isActive - triggerWebhookUrl - webhookSecret - identityHmacSecret - identityJwt - application - apiKeysOverride - allowEndUserWorkflows - allowEndUserDatabaseCollections - allowEndUserKnowledgeCollections - region - createdAt - updatedAt UserSocialAccount: type: object properties: id: type: string provider: type: string providerId: type: string userId: type: string user: $ref: '#/components/schemas/User' createdAt: format: date-time type: string updatedAt: format: date-time type: string required: - id - provider - providerId - userId - user - createdAt - updatedAt Role: type: object properties: id: type: string name: type: string enum: - admin - user description: type: string users: type: array items: $ref: '#/components/schemas/User' createdAt: format: date-time type: string updatedAt: format: date-time type: string required: - id - name - description - users - createdAt - updatedAt UserSession: type: object properties: id: type: string user: $ref: '#/components/schemas/User' userId: type: string ipAddress: type: string userAgent: type: string deviceType: type: string deviceName: type: string browser: type: string os: type: string location: type: string isActive: type: boolean lastActivityAt: format: date-time type: string expiresAt: format: date-time type: string createdAt: format: date-time type: string updatedAt: format: date-time type: string required: - id - user - userId - ipAddress - userAgent - deviceType - deviceName - browser - os - location - isActive - lastActivityAt - expiresAt - createdAt - updatedAt AuthConfigFieldsDto: type: object properties: authConfigCreation: $ref: '#/components/schemas/AuthConfigCreationFieldsDto' connectedAccountInitiation: $ref: '#/components/schemas/AuthConfigCreationFieldsDto' required: - authConfigCreation - connectedAccountInitiation AuthConfigProxyDto: type: object properties: baseUrl: type: string DeprecatedAuthProviderDetailsDto: type: object properties: authorization_url: type: string token_url: type: string AuthRecipeStepDto: type: object properties: id: type: string example: login method: type: string enum: - GET - POST - PUT - PATCH - DELETE example: POST url: type: string description: >- Absolute or toolkit-relative URL; supports {{email}} / {{password}} templates example: https://api.example.com/auth/login headers: type: object additionalProperties: type: string bodyTemplate: type: object description: JSON body object or raw string template onSuccess: type: string example: extract_session onChallenge: $ref: '#/components/schemas/AuthRecipeChallengeSpecDto' required: - id - method - url AuthRecipeSessionExtractDto: type: object properties: cookiesFromSetCookie: type: boolean description: Persist Set-Cookie values into state.val.cookies bearerFrom: type: string description: JSONPath for bearer/access token in the login response example: $.data.access_token fields: type: object description: Map response JSON paths → state.val keys additionalProperties: type: string AuthConfigFieldDto: type: object properties: name: type: string pattern: ^[A-Za-z][A-Za-z0-9_.-]{0,63}$ description: >- Field name: starts with a letter, then letters, digits, underscore, dot or hyphen (max 64) example: client_id displayName: type: string description: Field display name example: Client ID default: type: string nullable: true description: Default value example: your_client_id type: type: string description: Field type example: string description: type: string description: Field description example: Your application client ID required: type: boolean description: Whether field is required example: true legacyTemplateName: type: string description: Legacy template name example: client_id required: - name - displayName - default - type - description - required - legacyTemplateName ApiKey: type: object properties: id: type: string key: type: string name: type: string description: type: string project: $ref: '#/components/schemas/Project' projectId: type: string isActive: type: boolean expiresAt: format: date-time type: string lastUsedAt: format: date-time type: string permissions: type: array items: type: string createdAt: format: date-time type: string updatedAt: format: date-time type: string required: - id - key - name - description - project - projectId - isActive - expiresAt - lastUsedAt - permissions - createdAt - updatedAt User: type: object properties: id: type: string email: type: string password: type: string description: >- Never loaded unless a query asks for it explicitly (`addSelect('user.password')`). `LoadUserInterceptor` puts the full entity on `request.user`, and several endpoints return payloads built from user rows, so a selectable hash is one careless `relations: ['user']` away from being served to a client. Writes are unaffected: assigning a value and saving still persists it. socialAccounts: type: array items: $ref: '#/components/schemas/UserSocialAccount' firstName: type: string lastName: type: string roles: type: array items: $ref: '#/components/schemas/Role' sessions: type: array items: $ref: '#/components/schemas/UserSession' projects: type: array items: $ref: '#/components/schemas/Project' isActive: type: boolean tokenVersion: type: number description: >- Stamped into every access token and compared on each request, so a token can be revoked without a denylist. Logout and password reset bump it, which invalidates every token issued before that moment. createdAt: format: date-time type: string updatedAt: format: date-time type: string required: - id - email - password - socialAccounts - firstName - lastName - roles - sessions - projects - isActive - tokenVersion - createdAt - updatedAt AuthRecipeChallengeSpecDto: type: object properties: type: type: string example: otp next: type: string description: Next recipe step id after OTP is submitted example: verify_otp extract: type: object description: JSONPath-like map from response → vars additionalProperties: type: string whenStatus: example: - 200 - 202 type: array items: type: number whenBodyIncludes: type: array items: type: string collect: description: Challenge form fields. Omit to collect a single field named `type`. type: array items: $ref: '#/components/schemas/AuthRecipeChallengeCollectFieldDto' required: - type - next AuthRecipeChallengeCollectFieldDto: type: object properties: name: type: string example: verification_code displayName: type: string description: type: string required: type: boolean type: type: string example: otp required: - name securitySchemes: x-api-key: type: apiKey in: header name: x-api-key description: >- Project API key. Create and manage keys in the dashboard under Project → API Keys. Send as header: x-api-key: ```` This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.