Skip to main content
PATCH
Change what a connected agent may do

Authorizations

hookie_session
string
cookie
required

The console's sealed session cookie, set by WorkOS AuthKit. Mutating requests also require the X-Requested-With CSRF header.

Path Parameters

grant_id
string
required

Grant id from listConnectedAgents.

Body

application/json
scopes
enum<string>[]
required

Full replacement. Any unknown scope is REJECTED rather than silently dropped. An empty array leaves the agent with no Hookie scope, so its next admin-API request fails. hookie:manage clips to at most the admin role — billing is out of reach at every scope.

Available options:
hookie:read,
hookie:write,
hookie:manage

Response

Grant updated; effective on the agent's very next request (offline JWT verification is not consulted for scopes — this table is).

ok
enum<boolean>
required
Available options:
true
scopes
string[]
required

The sanitized scopes now stored.