Skip to content
Blotout Docs

Update a bundle link

PATCH
/developer/organizations/{organizationId}/bundles/{bundleId}/links/{linkId}
curl --request PATCH \
  --url https://qinto-api.blotout.io/developer/organizations/9c1d2b34-5e67-4f89-a0b1-2c3d4e5f6a7b/bundles/2b7e4d10-8a3c-4f56-9e21-7c0d5b8f3a64/links/5d2c8e71-3f4a-4b90-8c16-e7a9d0b2f345 \
  --header 'Authorization: Bearer <token>' \
  --header 'Content-Type: application/json' \
  --data '{ "label": "Acme partner offer", "limit": 25 }'

Replaces a link’s label and limit, and keeps its URL. A limit below the current use count is accepted and only stops further purchases.

Required permissions

  • None beyond a valid token; requires an OAuth token with the developer or bundles scope, for an owner of the addressed organization or a member with the bundles finance area and all apps

Authorizations

Section titled “Authorizations”

Parameters

Section titled “Parameters”

Path Parameters

Section titled “Path Parameters”
organizationId
required

Unique id (UUID) of the organization that owns the bundles, as listed by GET /me under organizations.

string format: uuid

Example 

9c1d2b34-5e67-4f89-a0b1-2c3d4e5f6a7b

Unique id (UUID) of the organization that owns the bundles, as listed by GET /me under organizations.

bundleId
required

Unique id (UUID) of the bundle, as returned by the create and list operations.

string format: uuid

Example 

2b7e4d10-8a3c-4f56-9e21-7c0d5b8f3a64

Unique id (UUID) of the bundle, as returned by the create and list operations.

linkId
required

Unique id (UUID) of the link, as returned by the create and list operations.

string format: uuid

Example 

5d2c8e71-3f4a-4b90-8c16-e7a9d0b2f345

Unique id (UUID) of the link, as returned by the create and list operations.

Request Bodyrequired

Section titled “Request Bodyrequired”

The replacement label and limit.

Media typeapplication/json
object
label
required

What to call the link, 1-100 characters.

string
>= 1 characters <= 100 characters

Example 

Acme partner offer
limit
required
Any of:

A whole number from 1 to 1000000.

integer
>= 1 <= 1000000

Example 

25

Responses

Section titled “Responses”

200

Section titled “200”

The updated link.

Media typeapplication/json
object
link
required

A link that offers a private bundle to whoever holds it.

object
linkId
required

Server-assigned unique id of the link.

string
bundleId
required

Id of the bundle the link belongs to.

string
label
required

What the developer calls the link.

string
limit
required
Any of:

How many teams can buy through the link.

integer
token
required

The token in the link’s URL. It stays readable, so the link can be copied again at any time.

string
url
required

The URL to send to a team.

string
useCount
required

How many teams have bought through the link.

integer
revokedAt
required

When the link was revoked, as an ISO 8601 UTC timestamp. Null while it is not revoked.

string | null format: date-time
createdByUserId
required

Id of the user who created the link. Null once that user is deleted.

string | null
createdAt
required

When the link was created, as an ISO 8601 UTC timestamp.

string format: date-time

Example 

{
  "link": {
    "linkId": "5d2c8e71-3f4a-4b90-8c16-e7a9d0b2f345",
    "bundleId": "2b7e4d10-8a3c-4f56-9e21-7c0d5b8f3a64",
    "label": "Acme partner offer",
    "limit": 25,
    "token": "3f9a1c7e5b2d4806a1e3c5f7092b4d6e8f0a1c3e5b7d9f1a2c4e6b8d0f2a4c6e",
    "url": "https://platform.blotout.io/bundles/link?token=3f9a1c7e5b2d4806a1e3c5f7092b4d6e8f0a1c3e5b7d9f1a2c4e6b8d0f2a4c6e",
    "useCount": 0,
    "revokedAt": "2026-11-05T00:00:00.000Z",
    "createdByUserId": "c7d1e2f3-4a5b-4c6d-8e9f-0a1b2c3d4e5f",
    "createdAt": "2026-11-05T00:00:00.000Z"
  }
}

400

Section titled “400”

invalid_params — A path parameter failed validation (for example a malformed UUID); details pinpoints the offending parameter. invalid_body — The JSON body is unparseable or failed schema validation; details pinpoints the offending fields when the body could be parsed. invalid_bundle — The bundle details were rejected, such as a name or description that is empty or too long, a description with a line break, an app that is not a published app of the organization, or a price, trial, site limit, service, link label or link limit out of range. message states which.

Media typeapplication/json
object
error
required

Machine-readable error slug; switch on this value rather than on the HTTP status alone.

string
Allowed values: invalid_params invalid_body invalid_bundle
message

Human-readable reason for this specific failure, intended for display — do not parse it programmatically.

string
details

Field-level validation errors: a tree keyed by input property, each node carrying an errors array of human-readable messages. Render it to help the caller correct the request.

object
key
additional properties

Example 

{
  "error": "invalid_params",
  "message": "The Cloudflare API token is invalid or expired.",
  "details": {
    "errors": [],
    "properties": {
      "teamId": {
        "errors": [
          "Invalid UUID"
        ]
      }
    }
  }
}

401

Section titled “401”

unauthenticated — The Authorization: Bearer token is missing, malformed, or no longer valid. Generate a team API token or obtain a new OAuth access token.

Media typeapplication/json
object
error
required

Machine-readable error slug; switch on this value rather than on the HTTP status alone.

string
Allowed values: unauthenticated

Example 

{
  "error": "unauthenticated"
}

403

Section titled “403”

forbidden — The bearer credential lacks the required permission or belongs to another team, or its user lacks the organization role a developer operation needs. Update its policies, use a credential bound to the addressed team, or ask an organization owner for the role; message states the reason when one is known. bundles_scope_required — The bearer credential has neither the developer nor the bundles scope, so it reaches no bundle operation whatever the role of its user. Authorize again to get a token with one of them.

Media typeapplication/json
object
error
required

Machine-readable error slug; switch on this value rather than on the HTTP status alone.

string
Allowed values: forbidden bundles_scope_required
message

Human-readable reason for this specific failure, intended for display — do not parse it programmatically.

string

Example 

{
  "error": "forbidden",
  "message": "The Cloudflare API token is invalid or expired."
}

404

Section titled “404”

not_found — The addressed resource does not exist within this team; check the id and retry.

Media typeapplication/json
object
error
required

Machine-readable error slug; switch on this value rather than on the HTTP status alone.

string
Allowed values: not_found

Example 

{
  "error": "not_found"
}

409

Section titled “409”

bundle_link_revoked — The link is revoked, which is permanent: the developer can’t change it and a team can’t buy through it. Nothing changed. The developer creates a new link instead.

Media typeapplication/json
object
error
required

Machine-readable error slug; switch on this value rather than on the HTTP status alone.

string
Allowed values: bundle_link_revoked
message

Human-readable reason for this specific failure, intended for display — do not parse it programmatically.

string

Example 

{
  "error": "bundle_link_revoked",
  "message": "The Cloudflare API token is invalid or expired."
}

500

Section titled “500”

internal — Unexpected server error. Nothing is guaranteed to have been persisted; idempotent operations are safe to retry.

Media typeapplication/json
object
error
required

Machine-readable error slug; switch on this value rather than on the HTTP status alone.

string
Allowed values: internal

Example 

{
  "error": "internal"
}