# Update app origin allowlist > For the complete documentation index, see [llms.txt](/docs/llms.txt). PUT https://admin-api.alchemy.com/v1/apps/{id}/origin-allowlist Replaces the origin allowlist for an application, controlling which domain origins are allowed to make requests. Accepts full URLs or bare domains. The provided list fully replaces the existing allowlist. Reference: https://www.alchemy.com/docs/tutorials/tools/admin-api/admin-api-endpoints/update-app-origin-allowlist ## Headers | Name | Type | Required | Description | |------|------|----------|-------------| | Authorization | string | Yes | Bearer authentication token | ## Path Parameters | Name | Type | Required | Description | |------|------|----------|-------------| | id | string | Yes | | ## Code Examples ### cURL ```bash curl --request PUT \ --url https://admin-api.alchemy.com/v1/apps/string/origin-allowlist \ --header 'Authorization: Bearer ' \ --header 'Content-Type: application/json' \ --data '{ "originAllowlist": [ { "name": "Primary", "value": "https://example.com" } ] }' ``` ### JavaScript ```javascript const options = { method: 'PUT', headers: {'Content-Type': 'application/json', Authorization: 'Bearer '}, body: JSON.stringify({originAllowlist: [{name: 'Primary', value: 'https://example.com'}]}) }; fetch('https://admin-api.alchemy.com/v1/apps/string/origin-allowlist', options) .then(res => res.json()) .then(res => console.log(res)) .catch(err => console.error(err)); ``` ### Python ```python import requests url = "https://admin-api.alchemy.com/v1/apps/string/origin-allowlist" payload = { "originAllowlist": [ { "name": "Primary", "value": "https://example.com" } ] } headers = { "Content-Type": "application/json", "Authorization": "Bearer " } response = requests.put(url, json=payload, headers=headers) print(response.text) ``` ### Go ```go package main import ( "fmt" "strings" "net/http" "io" ) func main() { url := "https://admin-api.alchemy.com/v1/apps/string/origin-allowlist" payload := strings.NewReader("{\n \"originAllowlist\": [\n {\n \"name\": \"Primary\",\n \"value\": \"https://example.com\"\n }\n ]\n}") req, _ := http.NewRequest("PUT", url, payload) req.Header.Add("Content-Type", "application/json") req.Header.Add("Authorization", "Bearer ") res, _ := http.DefaultClient.Do(req) defer res.Body.Close() body, _ := io.ReadAll(res.Body) fmt.Println(string(body)) } ``` ### Java ```java HttpResponse response = Unirest.put("https://admin-api.alchemy.com/v1/apps/string/origin-allowlist") .header("Content-Type", "application/json") .header("Authorization", "Bearer ") .body("{\n \"originAllowlist\": [\n {\n \"name\": \"Primary\",\n \"value\": \"https://example.com\"\n }\n ]\n}") .asString(); ``` ### C# ```csharp using RestSharp; var options = new RestClientOptions("https://admin-api.alchemy.com/v1/apps/string/origin-allowlist"); var client = new RestClient(options); var request = new RestRequest(""); request.AddHeader("Authorization", "Bearer "); request.AddJsonBody("{\n \"originAllowlist\": [\n {\n \"name\": \"Primary\",\n \"value\": \"https://example.com\"\n }\n ]\n}", false); var response = await client.PutAsync(request); Console.WriteLine("{0}", response.Content); ``` ## Operation Specification ```yaml path: /v1/apps/{id}/origin-allowlist method: PUT operation: operationId: UpdateAppOriginAllowlist responses: '200': description: Updated app origin allowlist successfully content: application/json: schema: description: |- Standard API response wrapper. All API responses are wrapped in this format for consistency. properties: data: properties: id: type: string description: App ID name: type: string description: Display name description: type: string description: Description apiKey: type: string description: API key to access chain network webhookApiKey: type: string description: API key used to access webhook's management API chainNetworks: items: properties: name: type: string description: Display name id: type: string description: Alchemy chain network id in the form of `{chain}_{network}` (e.g. `ETH_MAINNET`) networkChainId: type: string nullable: true description: EIP-155 network chain id when available. Null for non-EVM chains. rpcUrl: type: string description: HTTPS RPC endpoint wsUrl: type: string description: WebSocket endpoint grpcUrl: type: string description: gRPC endpoint (when available, e.g. Solana) required: - name - id - rpcUrl type: object additionalProperties: false type: array description: Networks configured for this app products: items: enum: - node-api - nft-api - swaps-api - block-timestamp-api - token-api - transfers-api - bundler-api - debug-api - embedded-accounts - gas-manager-api - trace-api - prices-api - transaction-simulation-api - transaction-receipts-api - user-operations-api - smart-websockets - webhooks - grpc type: string type: array description: Products enabled for this app addressAllowlist: items: properties: name: type: string description: Label for the allowlist entry. example: Primary value: type: string description: Wallet address value. example: '0x0000000000000000000000000000000000000001' required: - value type: object additionalProperties: false type: array description: Address allowlist entries for this app originAllowlist: items: properties: name: type: string description: Label for the allowlist entry. example: Primary value: type: string description: Origin value. Accepts full URLs or bare domains. example: https://example.com required: - value type: object additionalProperties: false type: array description: Origin allowlist entries for this app ipAllowlist: items: properties: name: type: string description: Label for the allowlist entry. example: Office value: type: string description: IP address or CIDR range. example: 203.0.113.1 required: - value type: object additionalProperties: false type: array description: IP allowlist entries for this app createdAt: type: string description: Creation timestamp (ISO 8601) required: - id - name - apiKey - webhookApiKey - chainNetworks - products - addressAllowlist - originAllowlist - ipAllowlist - createdAt type: object additionalProperties: false required: - data type: object additionalProperties: false '400': description: Invalid input content: application/json: schema: description: |- Standard error response wrapper. All error responses are wrapped in this format for consistency. properties: error: properties: message: type: string code: anyOf: - type: integer format: int32 - enum: - 500 - 400 - 401 - 403 - 404 - 200 - 201 - 1000 type: number status: type: integer format: int32 context: description: Additional information about the error specific to the endpoint. properties: {} type: object additionalProperties: {} required: - message - code - status type: object additionalProperties: false required: - error type: object additionalProperties: false examples: Example 1: value: error: code: 400 status: 400 message: Invalid input '401': description: Requires authentication content: application/json: schema: description: |- Standard error response wrapper. All error responses are wrapped in this format for consistency. properties: error: properties: message: type: string code: anyOf: - type: integer format: int32 - enum: - 500 - 400 - 401 - 403 - 404 - 200 - 201 - 1000 type: number status: type: integer format: int32 context: description: Additional information about the error specific to the endpoint. properties: {} type: object additionalProperties: {} required: - message - code - status type: object additionalProperties: false required: - error type: object additionalProperties: false examples: Example 1: value: error: code: 401 status: 401 message: Requires authentication '403': description: Forbidden content: application/json: schema: description: |- Standard error response wrapper. All error responses are wrapped in this format for consistency. properties: error: properties: message: type: string code: anyOf: - type: integer format: int32 - enum: - 500 - 400 - 401 - 403 - 404 - 200 - 201 - 1000 type: number status: type: integer format: int32 context: description: Additional information about the error specific to the endpoint. properties: {} type: object additionalProperties: {} required: - message - code - status type: object additionalProperties: false required: - error type: object additionalProperties: false examples: Example 1: value: error: code: 403 status: 403 message: Forbidden '404': description: App not found content: application/json: schema: description: |- Standard error response wrapper. All error responses are wrapped in this format for consistency. properties: error: properties: message: type: string code: anyOf: - type: integer format: int32 - enum: - 500 - 400 - 401 - 403 - 404 - 200 - 201 - 1000 type: number status: type: integer format: int32 context: description: Additional information about the error specific to the endpoint. properties: {} type: object additionalProperties: {} required: - message - code - status type: object additionalProperties: false required: - error type: object additionalProperties: false examples: Example 1: value: error: code: 404 status: 404 message: App not found description: Replaces the origin allowlist for an application, controlling which domain origins are allowed to make requests. Accepts full URLs or bare domains. The provided list fully replaces the existing allowlist. summary: Update app origin allowlist security: - api_key: - ADMIN_APPS_READ_WRITE - user_auth: - developer - admin parameters: - in: path name: id required: true schema: type: string requestBody: required: true content: application/json: schema: properties: originAllowlist: items: properties: name: type: string description: Label for the allowlist entry. example: Primary value: type: string description: Origin value. Accepts full URLs or bare domains. example: https://example.com required: - value type: object additionalProperties: false type: array description: Updated origin allowlist. required: - originAllowlist type: object additionalProperties: false ```