> ## Documentation Index > Fetch the complete documentation index at: https://developers.tassyir.io/llms.txt > Use this file to discover all available pages before exploring further. # Update a collection > Needs the `write_products` scope (permission `categories:update`). ## OpenAPI ````yaml /openapi/openapi.2026-10.json patch /apps/2026-10/collections/{id} openapi: 3.1.0 info: title: Tassyir Admin API version: 2026-10 summary: >- The API installed apps call to read and change a Tassyir business, and the webhooks they receive. description: >- Version `2026-10` of the API installed Tassyir apps call. The routes live under `/apps/2026-10/`; the token endpoint and the key documents under `/apps/`. Guides, and a page for every error code: https://developers.tassyir.io. **Authentication.** `Authorization: Bearer tsy_at_…` from `POST /apps/oauth/token`. An app acts as a team member of the business: it reads and writes only what its granted scopes allow, only in the stores the merchant gave it, under the merchant's plan. **Conventions.** JSON fields are camelCase; ids are strings; times are ISO 8601 UTC; money is a decimal string (`"2500.00"`) with a `currency` field, never a number. A list answers `{ data, nextCursor }`, newest first, keyset-paged: `limit` 1 to 100 (default 50), `cursor` = the previous `nextCursor`. A single resource answers `{ data }`. `fields` trims a resource to the named top-level fields. Fields without `read_customer_contact` (buyer name, phones, address, notes) are omitted, not nulled. Every answer is `Cache-Control: no-store`. **Writes.** Send an `Idempotency-Key` to make a write safe to retry (24 hours per installation). **Errors.** `application/problem+json` with a stable `code`, a `fix` sentence, the `docs` page of the code and a `requestId`. Each operation lists every code it can answer; `x-tassyir-errors` lists every code a problem can carry, with its title, statuses and `fix`. HTTP 460 `STORE_SCOPE_FORBIDDEN` means a store outside the installation's stores. **Rate limits.** A leaky bucket per installation, by default 40 requests refilled at 4 a second: every answer carries `RateLimit-Limit`, `RateLimit-Remaining` and `RateLimit-Reset`; a refusal is 429 `RATE_LIMITED` with `Retry-After`. All the apps of one business also share a ceiling, by default 20 requests a second: 429 `BUSINESS_RATE_LIMITED` with `Retry-After`. An API process that is already running its maximum of app requests answers 503 `API_BUSY` with `Retry-After`, having done nothing. **Webhooks.** Signed Standard Webhooks deliveries (`v1a`, Ed25519), one per topic below; verify them with `GET /apps/webhook-keys`. servers: - url: https://api.tassyir.io security: - appAccessToken: [] tags: - name: Authentication description: Tokens and the public keys apps verify with. - name: Business description: The business the app is installed on. - name: Orders description: Orders, their comments and the cancel reasons. - name: Products description: Products and their variants. - name: Collections description: Collections and their members. - name: Inventory description: Stock levels. - name: Customers description: The buyers behind the orders. - name: Stores description: The installation's stores. - name: Delivery description: Delivery agents and fee groups (never credentials). - name: Data description: >- Typed values the app keeps on the business, its stores, products, orders and customers, under keys its manifest declares. - name: Images description: >- Images re-hosted on the Tassyir CDN, for the product and collection writes. - name: Bulk exports description: >- A whole list (orders, products, customers) as one JSON Lines file, instead of paging through it. - name: Webhooks description: What Tassyir POSTs to the app. paths: /apps/2026-10/collections/{id}: patch: tags: - Collections summary: Update a collection description: Needs the `write_products` scope (permission `categories:update`). operationId: updateCollection parameters: - name: id in: path required: true description: >- A resource id. One this installation cannot read, or a malformed one, is 404 `NOT_FOUND`. schema: type: string minLength: 1 - name: fields in: query required: false schema: maxLength: 1000 type: string description: >- Return only these top-level fields, separated by commas; the id is always kept. The response schema describes the whole resource. An unknown name is 400 `INVALID_FIELDS`. Fields: `id`, `storeId`, `parentId`, `name`, `description`, `image`, `active`, `sortOrder`, `productSort`, `ruleMatch`, `rules`, `productsCount`, `createdAt`, `updatedAt`. - $ref: '#/components/parameters/IdempotencyKey' requestBody: required: true content: application/json: schema: $ref: '#/components/schemas/UpdateCollectionInput' responses: '200': description: The collection as it is now. headers: RateLimit-Limit: $ref: '#/components/headers/RateLimit-Limit' RateLimit-Remaining: $ref: '#/components/headers/RateLimit-Remaining' RateLimit-Reset: $ref: '#/components/headers/RateLimit-Reset' X-Request-Id: $ref: '#/components/headers/X-Request-Id' Cache-Control: $ref: '#/components/headers/Cache-Control-No-Store' Idempotent-Replayed: $ref: '#/components/headers/Idempotent-Replayed' content: application/json: schema: $ref: '#/components/schemas/CollectionResponse' '400': description: >- Bad request: `BAD_REQUEST`, `COLLECTION_RULE_INVALID`, `HTML_NOT_ALLOWED`, `IDEMPOTENCY_KEY_INVALID`, `INVALID_FIELDS`, `MEDIA_URL_NOT_ALLOWED`, `VALIDATION_FAILED`. headers: RateLimit-Limit: $ref: '#/components/headers/RateLimit-Limit' RateLimit-Remaining: $ref: '#/components/headers/RateLimit-Remaining' RateLimit-Reset: $ref: '#/components/headers/RateLimit-Reset' X-Request-Id: $ref: '#/components/headers/X-Request-Id' content: application/problem+json: schema: allOf: - $ref: '#/components/schemas/Problem' - properties: status: const: 400 code: enum: - BAD_REQUEST - COLLECTION_RULE_INVALID - HTML_NOT_ALLOWED - IDEMPOTENCY_KEY_INVALID - INVALID_FIELDS - MEDIA_URL_NOT_ALLOWED - VALIDATION_FAILED '401': $ref: '#/components/responses/Unauthorized' '403': description: 'Not allowed: `PERMISSION_DENIED`.' headers: RateLimit-Limit: $ref: '#/components/headers/RateLimit-Limit' RateLimit-Remaining: $ref: '#/components/headers/RateLimit-Remaining' RateLimit-Reset: $ref: '#/components/headers/RateLimit-Reset' X-Request-Id: $ref: '#/components/headers/X-Request-Id' content: application/problem+json: schema: allOf: - $ref: '#/components/schemas/Problem' - properties: status: const: 403 code: enum: - PERMISSION_DENIED '404': description: 'Not found: `COLLECTION_PARENT_NOT_FOUND`, `NOT_FOUND`.' headers: RateLimit-Limit: $ref: '#/components/headers/RateLimit-Limit' RateLimit-Remaining: $ref: '#/components/headers/RateLimit-Remaining' RateLimit-Reset: $ref: '#/components/headers/RateLimit-Reset' X-Request-Id: $ref: '#/components/headers/X-Request-Id' content: application/problem+json: schema: allOf: - $ref: '#/components/schemas/Problem' - properties: status: const: 404 code: enum: - COLLECTION_PARENT_NOT_FOUND - NOT_FOUND '409': description: >- Conflict: `COLLECTION_CONDITIONAL_LIMIT`, `COLLECTION_DEPTH_LIMIT`, `COLLECTION_PARENT_CYCLE`, `IDEMPOTENCY_KEY_IN_USE`. headers: RateLimit-Limit: $ref: '#/components/headers/RateLimit-Limit' RateLimit-Remaining: $ref: '#/components/headers/RateLimit-Remaining' RateLimit-Reset: $ref: '#/components/headers/RateLimit-Reset' X-Request-Id: $ref: '#/components/headers/X-Request-Id' content: application/problem+json: schema: allOf: - $ref: '#/components/schemas/Problem' - properties: status: const: 409 code: enum: - COLLECTION_CONDITIONAL_LIMIT - COLLECTION_DEPTH_LIMIT - COLLECTION_PARENT_CYCLE - IDEMPOTENCY_KEY_IN_USE '413': $ref: '#/components/responses/PayloadTooLarge' '415': $ref: '#/components/responses/UnsupportedMediaType' '422': description: 'Unprocessable: `IDEMPOTENCY_KEY_REUSED`.' headers: RateLimit-Limit: $ref: '#/components/headers/RateLimit-Limit' RateLimit-Remaining: $ref: '#/components/headers/RateLimit-Remaining' RateLimit-Reset: $ref: '#/components/headers/RateLimit-Reset' X-Request-Id: $ref: '#/components/headers/X-Request-Id' content: application/problem+json: schema: allOf: - $ref: '#/components/schemas/Problem' - properties: status: const: 422 code: enum: - IDEMPOTENCY_KEY_REUSED '429': $ref: '#/components/responses/RateLimited' '500': $ref: '#/components/responses/InternalError' '503': $ref: '#/components/responses/UnavailableForWrite' components: parameters: IdempotencyKey: name: Idempotency-Key in: header required: false description: >- Makes a write safe to retry: the same key with the same method, path, query and body within 24 hours answers the stored result (`Idempotent-Replayed: true`) without running the write again. Only a successful answer is stored, so a retry after a failure runs. A key reused for a different request is 422 `IDEMPOTENCY_KEY_REUSED`; one whose first request still runs is 409 `IDEMPOTENCY_KEY_IN_USE`. schema: type: string minLength: 1 maxLength: 255 pattern: ^[\x21-\x7E]+$ example: 3f2a1c9e-8a4b-4f5e-9d61-2c7b0e4a91d3 schemas: UpdateCollectionInput: type: object properties: name: maxLength: 255 type: string minLength: 1 description: anyOf: - maxLength: 20000 type: string - type: 'null' image: anyOf: - maxLength: 2048 type: string - type: 'null' parentId: anyOf: - type: string pattern: ^\d{1,24}$ description: An id (a string of digits). - type: 'null' sortOrder: maximum: 1000000 minimum: 0 type: integer active: type: boolean productSort: type: string enum: - UPDATED - NEWEST - OLDEST - PRICE_ASC - PRICE_DESC - NAME_ASC - NAME_DESC - MANUAL ruleMatch: anyOf: - type: string enum: - ALL - ANY - type: 'null' rules: maxItems: 10 type: array items: $ref: '#/components/schemas/CategoryRuleInput' additionalProperties: false CollectionResponse: type: object properties: data: $ref: '#/components/schemas/Collection' required: - data additionalProperties: false Problem: type: object description: >- An Admin API error (RFC 9457 problem details), served as `application/problem+json`. Act on `code`, never on `detail`. Other members name the subject of the refusal (`permission`, `storeId`, `feature`, `limit`, `errors`, …). properties: type: type: string format: uri description: >- `https://developers.tassyir.io/errors/`: identifies the code, and is the code's page. title: type: string status: type: integer detail: type: string description: >- For a person. A 5xx never carries an internal message: `requestId` names it. code: type: string pattern: ^[A-Z][A-Z0-9_]{1,63}$ description: 'Stable: what the app acts on.' fix: type: string description: One sentence an AI agent can act on. docs: type: string format: uri description: >- The page that explains the code and what to do: the same URL as `type`. requestId: type: string description: Also in the `X-Request-Id` header. Quote it to Tassyir. errors: type: array items: type: string description: 'With `VALIDATION_FAILED`: one entry per invalid parameter.' required: - type - title - status - detail - code - docs CategoryRuleInput: type: object properties: field: type: string enum: - BRAND - TAG - PRICE - ON_SALE - TITLE operator: type: string enum: - IS - IS_NOT - LESS_THAN - MORE_THAN - BETWEEN - CONTAINS - NOT_CONTAINS - STARTS_WITH - IS_TRUE - IS_FALSE valueRefIds: anyOf: - maxItems: 50 type: array items: type: string - type: 'null' valueNumber: anyOf: - type: number - type: 'null' valueNumberMax: anyOf: - type: number - type: 'null' valueText: anyOf: - maxLength: 200 type: string - type: 'null' additionalProperties: false required: - field - operator Collection: type: object properties: id: type: string minLength: 1 maxLength: 64 description: A resource id (a snowflake id, as a string). storeId: type: string minLength: 1 maxLength: 64 description: A resource id (a snowflake id, as a string). parentId: anyOf: - type: string minLength: 1 maxLength: 64 description: A resource id (a snowflake id, as a string). - type: 'null' description: The collection this one sits under, or null at top level. name: type: string description: anyOf: - type: string - type: 'null' description: HTML. image: anyOf: - type: string - type: 'null' active: type: boolean description: Shown on the storefront. sortOrder: type: integer minimum: -9007199254740991 maximum: 9007199254740991 description: Position among its siblings. productSort: type: string description: >- Storefront order of its products: UPDATED, NEWEST, OLDEST, PRICE_ASC, PRICE_DESC, NAME_ASC, NAME_DESC or MANUAL. ruleMatch: anyOf: - type: string - type: 'null' description: ALL or ANY of the conditions; null when it has no conditions. rules: type: array items: type: object properties: field: type: string description: BRAND, TAG, PRICE, ON_SALE or TITLE. operator: type: string description: >- IS, IS_NOT, LESS_THAN, MORE_THAN, BETWEEN, CONTAINS, NOT_CONTAINS, STARTS_WITH, IS_TRUE or IS_FALSE. valueRefIds: type: array items: type: string minLength: 1 maxLength: 64 description: A resource id (a snowflake id, as a string). description: 'BRAND and TAG: the brand or tag ids.' valueNumber: anyOf: - type: number - type: 'null' description: 'PRICE: the amount in DZD (the lower bound for BETWEEN).' valueNumberMax: anyOf: - type: number - type: 'null' description: 'PRICE with BETWEEN: the upper bound, inclusive.' valueText: anyOf: - type: string - type: 'null' description: 'TITLE: the text to look for.' required: - field - operator - valueRefIds - valueNumber - valueNumberMax - valueText additionalProperties: false description: The conditions; a product matching them is a member. productsCount: type: integer minimum: -9007199254740991 maximum: 9007199254740991 description: 'Its members: picked or matching, never excluded.' createdAt: type: string format: date-time pattern: >- ^(?:(?:\d\d[2468][048]|\d\d[13579][26]|\d\d0[48]|[02468][048]00|[13579][26]00)-02-29|\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\d|30)|(?:02)-(?:0[1-9]|1\d|2[0-8])))T(?:(?:[01]\d|2[0-3]):[0-5]\d(?::[0-5]\d(?:\.\d+)?)?(?:Z))$ description: ISO 8601 date-time, UTC. updatedAt: type: string format: date-time pattern: >- ^(?:(?:\d\d[2468][048]|\d\d[13579][26]|\d\d0[48]|[02468][048]00|[13579][26]00)-02-29|\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\d|30)|(?:02)-(?:0[1-9]|1\d|2[0-8])))T(?:(?:[01]\d|2[0-3]):[0-5]\d(?::[0-5]\d(?:\.\d+)?)?(?:Z))$ description: ISO 8601 date-time, UTC. required: - id - storeId - parentId - name - description - image - active - sortOrder - productSort - ruleMatch - rules - productsCount - createdAt - updatedAt additionalProperties: false description: A collection (API 2026-10). headers: RateLimit-Limit: description: >- The installation's request bucket (default 40); on a 429 `BUSINESS_RATE_LIMITED`, the business's ceiling (default 20 a second). Absent when a request is refused before the rate limits run (an unparsable body, a 503 `API_BUSY`). schema: minimum: 1 type: integer RateLimit-Remaining: description: Requests still accepted right now. schema: type: integer minimum: 0 RateLimit-Reset: description: >- Seconds until the bucket is empty again (it drains at 4 requests a second by default). schema: type: integer minimum: 0 X-Request-Id: description: The request's id, also in an error's `requestId`. schema: type: string Cache-Control-No-Store: description: '`no-store`: never cache an answer.' schema: type: string const: no-store Idempotent-Replayed: description: >- Present on the stored answer of a write repeated with the same `Idempotency-Key`: the write did not run again. schema: type: string const: 'true' Retry-After: description: Seconds to wait before retrying. schema: type: integer minimum: 0 responses: Unauthorized: description: 'No usable access token: `APP_TOKEN_INVALID`, `APP_TOKEN_REQUIRED`.' headers: RateLimit-Limit: $ref: '#/components/headers/RateLimit-Limit' RateLimit-Remaining: $ref: '#/components/headers/RateLimit-Remaining' RateLimit-Reset: $ref: '#/components/headers/RateLimit-Reset' X-Request-Id: $ref: '#/components/headers/X-Request-Id' WWW-Authenticate: description: The Bearer challenge (RFC 6750). schema: type: string content: application/problem+json: schema: allOf: - $ref: '#/components/schemas/Problem' - properties: status: const: 401 code: enum: - APP_TOKEN_INVALID - APP_TOKEN_REQUIRED PayloadTooLarge: description: 'Body too large: `PAYLOAD_TOO_LARGE`.' headers: RateLimit-Limit: $ref: '#/components/headers/RateLimit-Limit' RateLimit-Remaining: $ref: '#/components/headers/RateLimit-Remaining' RateLimit-Reset: $ref: '#/components/headers/RateLimit-Reset' X-Request-Id: $ref: '#/components/headers/X-Request-Id' content: application/problem+json: schema: allOf: - $ref: '#/components/schemas/Problem' - properties: status: const: 413 code: enum: - PAYLOAD_TOO_LARGE UnsupportedMediaType: description: 'Unsupported body: `UNSUPPORTED_MEDIA_TYPE`.' headers: RateLimit-Limit: $ref: '#/components/headers/RateLimit-Limit' RateLimit-Remaining: $ref: '#/components/headers/RateLimit-Remaining' RateLimit-Reset: $ref: '#/components/headers/RateLimit-Reset' X-Request-Id: $ref: '#/components/headers/X-Request-Id' content: application/problem+json: schema: allOf: - $ref: '#/components/schemas/Problem' - properties: status: const: 415 code: enum: - UNSUPPORTED_MEDIA_TYPE RateLimited: description: 'Rate limited: `BUSINESS_RATE_LIMITED`, `RATE_LIMITED`.' headers: RateLimit-Limit: $ref: '#/components/headers/RateLimit-Limit' RateLimit-Remaining: $ref: '#/components/headers/RateLimit-Remaining' RateLimit-Reset: $ref: '#/components/headers/RateLimit-Reset' X-Request-Id: $ref: '#/components/headers/X-Request-Id' Retry-After: $ref: '#/components/headers/Retry-After' content: application/problem+json: schema: allOf: - $ref: '#/components/schemas/Problem' - properties: status: const: 429 code: enum: - BUSINESS_RATE_LIMITED - RATE_LIMITED InternalError: description: 'Internal error: `INTERNAL_ERROR`.' headers: RateLimit-Limit: $ref: '#/components/headers/RateLimit-Limit' RateLimit-Remaining: $ref: '#/components/headers/RateLimit-Remaining' RateLimit-Reset: $ref: '#/components/headers/RateLimit-Reset' X-Request-Id: $ref: '#/components/headers/X-Request-Id' content: application/problem+json: schema: allOf: - $ref: '#/components/schemas/Problem' - properties: status: const: 500 code: enum: - INTERNAL_ERROR UnavailableForWrite: description: >- Unavailable: `API_BUSY`, `IDEMPOTENCY_UNAVAILABLE`, `SERVICE_UNAVAILABLE`. headers: RateLimit-Limit: $ref: '#/components/headers/RateLimit-Limit' RateLimit-Remaining: $ref: '#/components/headers/RateLimit-Remaining' RateLimit-Reset: $ref: '#/components/headers/RateLimit-Reset' X-Request-Id: $ref: '#/components/headers/X-Request-Id' Retry-After: $ref: '#/components/headers/Retry-After' content: application/problem+json: schema: allOf: - $ref: '#/components/schemas/Problem' - properties: status: const: 503 code: enum: - API_BUSY - IDEMPOTENCY_UNAVAILABLE - SERVICE_UNAVAILABLE securitySchemes: appAccessToken: type: http scheme: bearer bearerFormat: tsy_at_<43 base62> description: >- An app access token from `POST /apps/oauth/token`, valid 1 hour. An offline token acts as the app; an online token acts as the app on behalf of one dashboard user (the intersection of both permission sets). ```` This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.