Skip to main content
PATCH
Change a collection's members

Authorizations

Authorization
string
header
required

An app access token from POST /apps/oauth/token, valid 1 hour. An offline token acts as the app; an online token acts as the app on behalf of one dashboard user (the intersection of both permission sets).

Headers

Idempotency-Key
string

Makes a write safe to retry: the same key with the same method, path, query and body within 24 hours answers the stored result (Idempotent-Replayed: true) without running the write again. Only a successful answer is stored, so a retry after a failure runs. A key reused for a different request is 422 IDEMPOTENCY_KEY_REUSED; one whose first request still runs is 409 IDEMPOTENCY_KEY_IN_USE.

Required string length: 1 - 255
Pattern: ^[\x21-\x7E]+$

Path Parameters

id
string
required

A resource id. One this installation cannot read, or a malformed one, is 404 NOT_FOUND.

Minimum string length: 1

Query Parameters

fields
string

Return only these top-level fields, separated by commas; the id is always kept. The response schema describes the whole resource. An unknown name is 400 INVALID_FIELDS. Fields: id, storeId, parentId, name, description, image, active, sortOrder, productSort, ruleMatch, rules, productsCount, createdAt, updatedAt.

Maximum string length: 1000

Body

application/json
add
string[]

An id (a string of digits).

Maximum array length: 250
Pattern: ^\d{1,24}$
remove
string[]

An id (a string of digits).

Maximum array length: 250
Pattern: ^\d{1,24}$

Response

The collection as it is now.

data
object
required

A collection (API 2026-10).