# Update projects URL: https://docs.hanzo.ai/docs/openapi/project/patch-projects-by-slug > Changes a project's settings, and only the settings you send. `PATCH /v1/projects/{slug}` > [Project →](https://docs.hanzo.ai/docs/openapi/project) · [All API references →](https://docs.hanzo.ai/docs/openapi) · [Get started →](https://docs.hanzo.ai/docs/guides) | | | | ------------- | ----------------------------------------- | | **Address** | `https://api.hanzo.ai/v1/projects/{slug}` | | **Method** | `PATCH` | | **Operation** | `patch_projects_by_slug` | | **Auth** | `Authorization: Bearer $HANZO_API_KEY` | Changes a project's settings, and only the settings you send. Every field is optional and absent means "leave it": `name` may not be blanked, `framework` must stay a known build hint, and `cacheControl` is capped at 256 characters with no newlines (it becomes a response header). `visibility` flips public/private under the same rule as create — public is free, private needs a funded org. `upstream` and `license` are free-text credit for third-party work, and sending "" clears one. Changing anything reconciles the project's canonical git repo, so a visibility change reaches the source and not just the listing. `hidden`/`hiddenReason` are platform MODERATION and are ignored unless the caller is a platform admin; they remove a project from the public catalogue without touching the publisher's own visibility choice, so un-hiding restores exactly what they asked for. Scope: a validated principal is required (401 without one) and the project is resolved within that principal's org, so another tenant's slug is a 404. ## Request 18 fields, body `application/json` (required). | Field | In | Type | Required | Description | | ------------------ | ---- | --------- | -------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | `slug` | path | string | yes | Slug is the project to update, from the path. | | `cacheControl` | body | string | — | CacheControl replaces the Cache-Control policy the edge serves this site's HTML under. | | `description` | body | string | — | Description replaces the one-line summary. | | `dropLocal` | body | boolean | — | DropLocal turns the drop of localhost events at ingest on or off. | | `framework` | body | string | — | Framework replaces the build hint. | | `hidden` | body | boolean | — | Hidden is MODERATION, and the only admin-gated field on this body: it pulls a public project out of the catalogue from admin.hanzo.ai without editing the publisher's own visibility choice, so un-hiding restores exactly what they asked for. | | `hiddenReason` | body | string | — | HiddenReason records WHY moderation hid it, so the action can be explained and reviewed later. | | `internalNetworks` | body | string\[] | — | InternalNetworks replaces the site's own addresses: CIDRs or bare addresses, at most 64. | | `license` | body | string | — | License is the terms that upstream work carries, with the same clear-versus- leave rule. | | `name` | body | string | — | Name replaces the display name. | | `repo` | body | object | — | Repo relinks the git source. | | `repo.branch` | body | string | — | | | `repo.url` | body | string | — | | | `slug` | body | string | — | Slug is the project to update, from the path. | | `tags` | body | object | — | Tags sets the site's browser tag config: platform slug → non-secret pixel id (e.g. {"ga4":"G-…","meta":"…"}). | | `tags.*` | body | string | — | | | `upstream` | body | string | — | Upstream credits the third-party work this project was published from, and is settable after the fact because the live demos are the ones that most need crediting. | | `visibility` | body | string | — | Visibility flips an existing project between "public" and "private". | ## Response | Status | Body | Meaning | | --------- | ----------------------- | ------- | | `200` | project.projectsProject | ok | | `default` | problem-details | refused | `200` body — 32 fields. | Field | In | Type | Always | Description | | --------------------- | ---- | -------------------- | ------ | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | | `analytics` | body | boolean | — | Analytics is whether the web-analytics beacon is injected into this site's pages. | | `bucket` | body | string | — | Bucket is the object-store bucket the site's files are served out of. | | `cacheControl` | body | string | — | CacheControl is the Cache-Control policy the edge serves this site's HTML under — how long a reader may hold a stale page before asking again. | | `createdAt` | body | integer (int64) | — | CreatedAt is when the project was created, as Unix seconds. | | `currentDeploymentId` | body | string | — | CurrentDeploymentID names the deployment currently serving, so a caller can ask what is live without scanning the history. | | `description` | body | string | — | Description is the one-line summary, which is copied onto forks of this project and shown on a gallery card. | | `dropLocal` | body | boolean | — | DropLocal is whether events a developer's own machine sends (localhost, 127.0.0.1, \*.local) are dropped at ingest. | | `forkedFrom` | body | string | — | ForkedFrom is the parent this project was forked from ("\/\" of a published project, or a catalog template slug) — the attribution edge a gallery credits. | | `framework` | body | string | — | Framework is a BUILD HINT from a closed set, defaulting to static. | | `hidden` | body | boolean | — | Hidden is PLATFORM MODERATION, and it is a different axis from visibility: it pulls a public project out of the catalogue without editing the publisher's own choice, so un-hiding restores exactly what they asked for. | | `hiddenReason` | body | string | — | HiddenReason is why moderation hid it. | | `id` | body | string | — | ID is the project's internal identifier. | | `internalNetworks` | body | string\[] | — | InternalNetworks are the site's own addresses, as CIDRs ("203.0.113.0/24"). | | `key` | body | string | — | Key is the project's publishable ingest key, minted at create. | | `lastPurgeAt` | body | integer (int64) | — | LastPurgeAt is when the edge cache was last cleared, as Unix seconds, so a console can say how fresh what readers see actually is. | | `license` | body | string | — | License is the terms that upstream work carries. | | `liveUrl` | body | string | — | LiveURL is where the site answers today. | | `name` | body | string | — | Name is the project's display name, free text a person chose. | | `org` | body | string | — | Org is the organisation that owns the project, and therefore who pays for it and who may change it. | | `repo` | body | project.projectsRepo | — | | | `repo.branch` | body | string | — | Branch is the ref a push has to touch for this project to rebuild. | | `repo.provider` | body | string | — | Provider is the forge the URL was recognised as — it decides which webhook and which credential reach the repository, and is DERIVED from the URL rather than chosen by the caller. | | `repo.url` | body | string | — | URL is the clone address of the repository this project builds from. | | `slug` | body | string | — | Slug is the identifier that MATTERS: the handle every later call addresses, the S3 key segment the site's objects live under, and the label of the public host `<slug>.hanzo.app`. | | `space` | body | string | — | Space is the project's Base data space, which is where a deployed site's form, forum and data submissions land. | | `starred` | body | boolean | — | Starred is THIS CALLER's star, not a property of the project — two people in the same org see different values for the same row, which is the whole point of it. | | `status` | body | string | — | Status is where the project stands — whether a build has ever succeeded and whether anything is serving right now. | | `tags` | body | object | — | Tags is the site's browser tag config: platform slug → non-secret pixel id (GA measurement, Meta pixel, …) — what track.js injects and the server CAPI reads, per site. | | `tags.*` | body | string | — | | | `updatedAt` | body | integer (int64) | — | UpdatedAt is when the project's own record last changed, as Unix seconds. | | `upstream` | body | string | — | Upstream credits the third-party work this project was published from — a free-text line, because the honest answer is a name and a title that no enum could hold. | | `visibility` | body | string | — | Visibility is "public" or "private", and Hidden reports platform moderation. | Failure carries the platform error shape — see [Errors](https://docs.hanzo.ai/docs/errors). ## Examples **CLI** ```bash hanzo projects update ``` **SDK** **.ts** ```ts import { Configuration, ProjectApi } from 'hanzoai'; const api = new ProjectApi(new Configuration({ accessToken: process.env.HANZO_API_KEY })); const { data } = await api.patchProjectsBySlug({ slug: 'slug', cacheControl: "", description: "" }); ``` **.py** ```python from hanzoai.cloud import ApiClient, Configuration from hanzoai.cloud.api import ProjectApi client = ApiClient(Configuration(access_token=os.environ["HANZO_API_KEY"])) result = ProjectApi(client).patch_projects_by_slug(slug='slug', cache_control="", description="") ``` **.go** ```go cfg := hanzoai.NewConfiguration() cfg.AddDefaultHeader("Authorization", "Bearer "+os.Getenv("HANZO_API_KEY")) client := hanzoai.NewAPIClient(cfg) resp, _, err := client.ProjectAPI.PatchProjectsBySlug(context.Background()).Execute() if err != nil { return err } ``` **.rs** ```rust use hanzo_client::apis::{configuration::Configuration, project_api}; let mut cfg = Configuration::new(); cfg.bearer_access_token = std::env::var("HANZO_API_KEY").ok(); let result = project_api::patch_projects_by_slug(&cfg, Default::default()).await?; ``` **.java** ```java import ai.hanzo.cloud.ApiClient; import ai.hanzo.cloud.api.ProjectApi; ApiClient client = new ApiClient(); client.setBearerToken(System.getenv("HANZO_API_KEY")); var result = new ProjectApi(client).patchProjectsBySlug(); ``` The method above is the one at the current release of the document. `hanzoai@8.5.914` (npm) and `hanzoai@8.5.914` (PyPI) were generated from an earlier release, where this operation carried a different id, so it spells the method differently — regenerating the clients is what makes the two agree. [SDKs →](https://docs.hanzo.ai/docs/sdks) **HTTP** ```bash curl -X PATCH https://api.hanzo.ai/v1/projects/ \ -H "Authorization: Bearer $HANZO_API_KEY" \ -H "Content-Type: application/json" \ -d '{ "cacheControl": "", "description": "" }' ``` **MCP** Tool `project`, op `patch_projects_by_slug` — POST the JSON-RPC envelope to `https://api.hanzo.ai/v1/mcp`. ```bash curl -X POST https://api.hanzo.ai/v1/mcp \ -H "Authorization: Bearer $HANZO_API_KEY" \ -H "Content-Type: application/json" \ -d '{ "jsonrpc": "2.0", "id": 1, "method": "tools/call", "params": { "name": "project", "arguments": { "op": "patch_projects_by_slug", "input": { "slug": "", "cacheControl": "", "description": "" } } } }' ``` --- [Project API](https://docs.hanzo.ai/docs/openapi/project) · [All Hanzo APIs](https://docs.hanzo.ai/docs/openapi) · [Interactive reference](https://docs.hanzo.ai/docs/openapi/reference)