# Update an automation **PATCH /automations/{automation}** Changes an automation, including the graph. Needs `sending: write`, and is a write. **`steps` replaces the whole graph.** Leaving it out leaves the graph alone, which is what a rename is. Sending it replaces it entirely, and every gate the create runs runs again. **An edit applies to the runs already in flight.** A run sits on a step `id`, so a subscriber part way through the sequence picks up the new steps from wherever they are. That is the point of editing a live automation rather than replacing it. **It is also why removing a step can answer `409`.** If runs are waiting on a step this edit removes, the request is refused with how many and on which steps, because removing it would leave those subscribers part way through with nothing to advance them and nothing reporting it. Send `on_removed_step` to say what should happen: `"exit"` ends those runs, or a step `id` from the graph you are sending moves them there. Publishes no event. ## Servers - Production. There is no separate sandbox host. : https://api.usecommune.com (Production. There is no separate sandbox host. ) ## Authentication methods - Api key - Oauth2 ## Parameters ### Headers - **Idempotency-Key** (string) A value of your choosing naming the change this request is making. Send the same value again to retry the same request. Commune replays the answer the first attempt gave instead of making the change twice, and marks the replay with an `Idempotent-Replay: true` response header. Send a different value for a different change: a key reused for a request that differs in any way answers `409`, because replaying an answer to a question you did not ask is a wrong answer you could not detect. A UUID per change is the usual choice. Remembered for 24 hours, per credential, so two credentials choosing the same value never see each other's answers. Required, not optional. - **Commune-Version** (string) The contract version this request is written against. Every version published so far is a release date (`YYYY-MM-DD`), which is why the examples look like one, but the value is an opaque identifier: match it against the versions this API publishes rather than parsing it, because a future one may not be only a date. An unknown value answers `400` with `invalid_version`. Omitting the header pins the request to the version that was current when the API key was issued, so an integration keeps working when a newer version ships. ### Path parameters - **automation** (string(uuid)) The automation's `id`. An automation has no short id. ### Body: application/json (object) - **name** (string) - **trigger** (string) Changing it requires sending `steps` as well. A trigger decides what a condition may ask about and whether a step has anybody to act on, so a graph that was valid under one trigger may not be under another, and Commune checks the graph you send rather than guessing that the stored one still holds. Sending back the `steps` you just read is accepted unchanged. - **trigger_filter** (object | null) - **reentry** (boolean) - **steps** (array[object]) One step of the graph. **Only the fields your `type` uses.** A `wait` takes `duration`, a tag step takes `tag`, a `condition` takes `schema` with `then` and `else`, and a `send_email` takes `email`. Sending a field your type does not use is refused rather than ignored, because a field quietly dropped is something you believe you wrote and the engine will never see. `null` is accepted wherever a field is not used, so a body built by echoing a response back works unchanged. This is one schema rather than a union of five, deliberately. A body that fails a five-branch union reports five failures and names none of them as the branch you meant; the refusal here names the one rule that was broken. **Every edge is written down.** A null `next` means there is no edge, so the run ends at that step; a sequence sets `next` on each step to name the one after it. It used to default to the following entry in the array, which is the rule removed on `2026-10-14`; see Removals under Versioning. - **on_removed_step** (string) What should happen to the runs waiting on a step this edit removes. Without it, such an edit answers `409` naming how many runs are waiting and on which steps. A run sits on a step id, so removing the step would leave those subscribers part way through the sequence with nothing to advance them and nothing reporting it. `"exit"` ends those runs. Anything else is the `id` of a step in the graph you are sending, and the runs move there and carry on from it; a target that is not in the new graph is refused, because moving a run to a step that is also being removed would strand it again. Ignored when the edit removes no step that anything is waiting on, and refused when the request sends no `steps` at all, since then it removes nothing. ## Responses ### 200 The automation, as it now stands. #### Body: application/json (object) - **object** (string) Always `automation`. - **id** (string(uuid)) - **newsletter** (object | null) The newsletter this automation belongs to. A `Ref` unless `newsletter` is named in `?expand=`. - **name** (string) - **status** (string) Where an automation is in its life. `draft` is where every automation starts and the only status a create can produce. `active` is the one status that sends: the engine's ingest and its claim on due work both filter on it, so nothing an automation holds reaches anybody until somebody turns it on. `paused` holds every waiting run exactly where it is. A run three days into a sequence stays on that step and resumes from it when the automation is turned on again, so a pause is instant and total rather than a drain. `archived` is what `DELETE` leaves behind. It is not sending and it is not coming back: the runs it was in the middle of are ended, because a run holding its place on a graph nobody will activate again is a subscriber stuck part way through forever. The automation and its history stay readable, which is the reason it is archived rather than deleted. - **trigger** (string) The event that starts a run. Every topic Commune publishes is a trigger, including the ones that are not about a subscriber. An automation on `article.published` can hold conditions and waits; it cannot send an email or move a tag, because there is nobody for those to act on, and saving one that tries is refused rather than left to fail once per event forever. `GET /automation-triggers` says, per topic, which properties its events carry and whether it is about a subscriber. That is what a condition can ask about. - **trigger_filter** (object | null) - **reentry** (boolean) - **steps** (array[object]) The graph. The order is the order the steps are drawn and read back in, not the order they run: follow `next`, `then` and `else` for that. - **created_at** (string(date-time)) - **updated_at** (string(date-time)) - **activated_at** (string(date-time) | null) When this automation was last turned on, or null if it never has been. It is not cleared by pausing, so it answers "has this ever sent anything". ### 400 The request was malformed, and the same request will fail the same way until it is changed. `param` names the parameter or header at fault when there is exactly one, and `allowed_values` lists what it accepts when that is a finite set. The code is `bad_request` for every case below except the last. * **A query parameter**: one the operation does not have, a value outside its set, range or format (an unparseable cursor, an unknown `expand` path or `fields` name, an identifier that is not a UUID), or a required one left out, such as `q` on a search or `newsletter` when the credential reaches more than one. * **The request body**: not JSON, not the shape the operation reads, a property it does not write, or a value of the wrong type, length or format. `param` is absent here, since the body is not a parameter, and the message names the property. * **The `Idempotency-Key` header**, on an operation that changes something: missing, or a value this API will not store. * **An unrecognised `Commune-Version`**, which answers with its own code, `invalid_version`, because it is never fixed by changing the body. #### Body: application/json (object) - **error** (object) ### 401 No credential was presented, or it is malformed, unknown, revoked or expired, or it is an access token minted for a different audience. Every one of these answers identically, down to the wording and the headers, so a refusal never confirms that a string was once real. #### Headers - **WWW-Authenticate** (string) The authentication scheme this API accepts, and where to find out how to get a credential for it. Always `Bearer realm="Commune API", resource_metadata="https://api.usecommune.com/.well-known/oauth-protected-resource"`. `resource_metadata` is the RFC 9728 pointer to this API's protected resource metadata, which names the authorization server an OAuth client should send its user to. A client holding an API key can ignore it. The header carries no `error` parameter, not even `error="invalid_token"`, because it describes what this API accepts rather than what was wrong with the credential sent, and the reasons above are deliberately indistinguishable. There is no second scheme and no query-parameter fallback, because a credential that can travel in a URL ends up in access logs and referer headers. #### Body: application/json (object) - **error** (object) ### 402 The credential is allowed to do this but the newsletter's plan does not include it. Two surfaces can answer it: **insights**, the engagement and metrics operations, which are the only reads Commune reserves the right to meter, and **writing**, every operation that changes something. Every other read stays free on every plan, so a credential refused at one of these can still read everything else. The body names the plan the newsletter is on and the plans that would work. One refusal is a feature of the paid plan rather than a charge for API access, and it answers whatever is metered: a newsletter whose plan does not include it may have **one automation active at a time**, so `POST /automations/{automation}/activate` is refused while another is running. That one is also the only `402` a client can clear on its own, by pausing the automation that is running. **This status is predictable and should not be how you discover it.** `GET /newsletters/{newsletter}/entitlements` answers the same question in advance, carrying the same plan list this puts in `allowed_values` and the same sentence it puts in `message`. Read it once at the start of a run rather than finding out in the middle of one. #### Body: application/json (object) - **error** (object) ### 403 The credential is valid but is not allowed to do this. Two codes answer with this status, and `error.code` says which. **`insufficient_scope`: it does not hold the permission.** The operation needs, say, `audience: read` on the newsletter addressed, and this credential holds less than that there. `allowed_values` carries the permission that was needed, and the message says what the credential does hold on that newsletter, because a credential granted the wrong family and a credential belonging to somebody whose standing on the team has narrowed look identical without it. The answer can differ per newsletter: the same credential may be allowed here and refused on the next one it reaches. The same code answers an operation that needs the **account permission** from a credential that does not carry it. That permission is about the person a credential belongs to rather than about any newsletter, so nothing granted on a newsletter adds up to it. It is granted on the credential itself, when a key is minted or when an authorization asks for `account:read`. And it answers a parameter the credential may send, but not with the value it sent: a filter a credential holding only `read` permissions may not use, or an `expand` path whose rows need a permission the operation does not. `param` names the parameter, and `allowed_values` carries what this credential may send instead, or is absent when it may send nothing there at all. **`forbidden`: it may not act here at all.** Either the credential does not reach the newsletter addressed, because it was never granted it or because the person it belongs to can no longer act on it, or it reaches no newsletter at all; `param` is `newsletter`, and `GET /newsletters` lists the ones it does reach. Or, on `DELETE /api-keys/{key}`, the credential named belongs to somebody else. Neither carries `allowed_values`, because there is no value to send instead. #### Body: application/json (object) - **error** (object) ### 404 No such resource, or the key is not allowed to know that it exists. Commune answers `404` rather than `403` where distinguishing the two would leak the existence of private content. #### Body: application/json (object) - **error** (object) ### 409 The request collided with something. On a write this is always the `Idempotency-Key`, in one of two ways, and the message says which. Either the key was already used for a **different** request, which is refused rather than answered with the earlier request's result. Or an earlier request using the same key has not finished, or never reported an outcome, in which case this one was not run and the key becomes usable again shortly. Nothing was changed by a request that answers this. #### Headers - **Retry-After** (integer) Seconds to wait before retrying, on the second case only. #### Body: application/json (object) - **error** (object) ### 422 The request is well formed and every value in it is legal, and the state of what it addresses refuses it anyway. The message says what about that state is in the way. #### Body: application/json (object) - **error** (object) ### 429 Too many requests. Back off and retry after the interval named by the `Retry-After` response header. One of the budgets in `RateLimit-Policy` ran out, and the `RateLimit-*` headers on this response say which and when it resets. #### Headers - **Retry-After** (integer) Seconds to wait before retrying. #### Body: application/json (object) - **error** (object) ### 500 Something failed inside Commune. The request may be retried. #### Body: application/json (object) - **error** (object) [Powered by Bump.sh](https://bump.sh)