curl -X PATCH https://tawked.com/v1/partner/applications/store_88 \
-H "Authorization: Bearer tk_partner_xxxxxxxxxxxxxxxxxxxx" \
-H "Content-Type: application/json" \
-d '{
"name_ar": "متجر الورد الجديد",
"name_en": "New Flower Shop",
"website": "https://flowers.example"
}'const res = await fetch("https://tawked.com/v1/partner/applications/store_88", {
method: "PATCH",
headers: {
Authorization: "Bearer tk_partner_xxxxxxxxxxxxxxxxxxxx",
"Content-Type": "application/json",
},
body: JSON.stringify({
"name_ar": "متجر الورد الجديد",
"name_en": "New Flower Shop",
"website": "https://flowers.example"
}),
});
const data = await res.json();<?php
$curl = curl_init();
curl_setopt_array($curl, [
CURLOPT_URL => "https://tawked.com/v1/partner/applications/{external_id}",
CURLOPT_RETURNTRANSFER => true,
CURLOPT_ENCODING => "",
CURLOPT_MAXREDIRS => 10,
CURLOPT_TIMEOUT => 30,
CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
CURLOPT_CUSTOMREQUEST => "PATCH",
CURLOPT_POSTFIELDS => json_encode([
'name_ar' => '<string>',
'name_en' => '<string>',
'website' => '<string>',
'industry' => '<string>',
'merchant' => [
],
'verify' => [
],
'metadata' => [
]
]),
CURLOPT_HTTPHEADER => [
"Authorization: Bearer <token>",
"Content-Type: application/json"
],
]);
$response = curl_exec($curl);
$err = curl_error($curl);
curl_close($curl);
if ($err) {
echo "cURL Error #:" . $err;
} else {
echo $response;
}import requests
res = requests.patch(
"https://tawked.com/v1/partner/applications/store_88",
headers={"Authorization": "Bearer tk_partner_xxxxxxxxxxxxxxxxxxxx"},
json={
"name_ar": "متجر الورد الجديد",
"name_en": "New Flower Shop",
"website": "https://flowers.example"
},
)
data = res.json(){
"service_id": "c2a10f3e-8b7a-4d2e-9c1a-1a2b3c4d5e6f",
"application_id": "c2a10f3e-8b7a-4d2e-9c1a-1a2b3c4d5e6f",
"external_id": "store_88",
"status": "review",
"screening": {
"result": "clean",
"rules": []
},
"verify": {
"code_length": 6,
"ttl_seconds": 300,
"max_attempts": 3,
"max_per_hour": 5,
"autofill_domain": "flowers.example",
"autofill_domain_enabled": true,
"android_app_hash": null,
"daily_spend_cap_halalas": null,
"max_per_ip_per_hour": 20,
"max_new_destinations_per_hour": 300
},
"paused": false
}{
"error": "invalid_json"
}{
"error": "unauthorized"
}{
"error": "ip_not_allowed"
}{
"error": "not_found"
}{
"error": "application_archived"
}{
"error": "too_many_requests"
}{
"error": "internal_error"
}Update the brand
Replaces the brand in full: name_ar, name_en and website are required on every call; industry, merchant and verify are optional. The names are screened again, and a change to a name or the website returns an active application to review until it is approved again, while a call that changes none of the three keeps the status. Codes refuse with 403 account_not_active while it is in review.
curl -X PATCH https://tawked.com/v1/partner/applications/store_88 \
-H "Authorization: Bearer tk_partner_xxxxxxxxxxxxxxxxxxxx" \
-H "Content-Type: application/json" \
-d '{
"name_ar": "متجر الورد الجديد",
"name_en": "New Flower Shop",
"website": "https://flowers.example"
}'const res = await fetch("https://tawked.com/v1/partner/applications/store_88", {
method: "PATCH",
headers: {
Authorization: "Bearer tk_partner_xxxxxxxxxxxxxxxxxxxx",
"Content-Type": "application/json",
},
body: JSON.stringify({
"name_ar": "متجر الورد الجديد",
"name_en": "New Flower Shop",
"website": "https://flowers.example"
}),
});
const data = await res.json();<?php
$curl = curl_init();
curl_setopt_array($curl, [
CURLOPT_URL => "https://tawked.com/v1/partner/applications/{external_id}",
CURLOPT_RETURNTRANSFER => true,
CURLOPT_ENCODING => "",
CURLOPT_MAXREDIRS => 10,
CURLOPT_TIMEOUT => 30,
CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
CURLOPT_CUSTOMREQUEST => "PATCH",
CURLOPT_POSTFIELDS => json_encode([
'name_ar' => '<string>',
'name_en' => '<string>',
'website' => '<string>',
'industry' => '<string>',
'merchant' => [
],
'verify' => [
],
'metadata' => [
]
]),
CURLOPT_HTTPHEADER => [
"Authorization: Bearer <token>",
"Content-Type: application/json"
],
]);
$response = curl_exec($curl);
$err = curl_error($curl);
curl_close($curl);
if ($err) {
echo "cURL Error #:" . $err;
} else {
echo $response;
}import requests
res = requests.patch(
"https://tawked.com/v1/partner/applications/store_88",
headers={"Authorization": "Bearer tk_partner_xxxxxxxxxxxxxxxxxxxx"},
json={
"name_ar": "متجر الورد الجديد",
"name_en": "New Flower Shop",
"website": "https://flowers.example"
},
)
data = res.json(){
"service_id": "c2a10f3e-8b7a-4d2e-9c1a-1a2b3c4d5e6f",
"application_id": "c2a10f3e-8b7a-4d2e-9c1a-1a2b3c4d5e6f",
"external_id": "store_88",
"status": "review",
"screening": {
"result": "clean",
"rules": []
},
"verify": {
"code_length": 6,
"ttl_seconds": 300,
"max_attempts": 3,
"max_per_hour": 5,
"autofill_domain": "flowers.example",
"autofill_domain_enabled": true,
"android_app_hash": null,
"daily_spend_cap_halalas": null,
"max_per_ip_per_hour": 20,
"max_new_destinations_per_hour": 300
},
"paused": false
}{
"error": "invalid_json"
}{
"error": "unauthorized"
}{
"error": "ip_not_allowed"
}{
"error": "not_found"
}{
"error": "application_archived"
}{
"error": "too_many_requests"
}{
"error": "internal_error"
}Authorizations
Authorization: Bearer . An application key (tk_live_, tk_test_) has full access, which covers every product and any product added later, or custom access, chosen when the key is created: one or more of the scopes verify:check, verify:send (includes verify:check), notifications:read, notifications:send (includes notifications:read), email:read, email:send (includes email:read), email:manage (includes email:send), webhooks:manage, email:inbound, notifications:templates (includes notifications:read), chat:menus, chat:attendant. No key made on the API keys page holds notifications:templates, full access included: the three template writes answer such a key 403 insufficient_scope. A connected app's key holds it. Nor chat:menus: the five conversation menu operations answer such a key 403 insufficient_scope, and a connected app's key holds it once the client approved it. Nor chat:attendant: the five auto-attendant operations answer such a key 403 insufficient_scope too, and a connected app's key holds it once the client approved it. email:manage and webhooks:manage are held only by a key someone chose them for: a full-access key, old or new, never holds them. email:inbound, which reads, deletes and forwards received e-mail, is opt-in on every key, full access included: a key holds it only when it was turned on when the key was created. A call outside the key's access answers 403 insufficient_scope and names the scope it needs in the WWW-Authenticate response header. A partner key (tk_partner_) always has full access. Whatever its access, a key is a server-side secret.
Headers
A 1 to 128 printable-ASCII key you generate, scoped to your API key. Replaying it with the same request answers the original 2xx unchanged, with the response header Idempotent-Replayed: true, and runs nothing again; the same key with another request answers 409 idempotency_key_reused, and a request still in flight 409 idempotency_in_progress. A refused request is never stored, so a corrected retry under the same key runs. Keys expire after 24 hours.
Path Parameters
Your own id for the application, as given at provisioning.
Body
The Arabic brand name end users see in their messages, 1 to 80 characters. Screened against protected brands and bait words.
The English brand name, 1 to 80 characters. Screened like name_ar.
The merchant's website, an http or https URL. The autofill domain is derived from it (its registrable domain) and is read-only; website_url is accepted as an alias.
Free text up to 64 characters; unchanged when omitted.
Your own record of the merchant, replaced as given when present and unchanged when omitted.
Verify settings to apply in the same call: any subset of the fields of the verify-settings endpoint. Omitted fields stay as they are.
Your own tags on the application: up to 20 string values of at most 200 characters under keys of 1 to 40 lowercase letters, digits and underscores. Replaced whole when present, unchanged when omitted, cleared by null or {}; never read by Tawked and not a brand change. A refused key is reported in fields as metadata. followed by the key. The list filters by it.