# Update App
## Endpoint
`/api/apps/update`
## Method
POST (multipart form data)
## Description
Allows manually updating an installed app by uploading a provided app zip file directly.
## Authentication
Required. Session token from `login` or `createToken`.
## Permissions
Apps: Delete
## Parameters
| token | string | Yes | No | The session token generated by the `login` or the `createToken` call. Passed as a query parameter in the URL. |
| name | string | Yes | No | The name of the app to update. Passed as a query parameter in the URL. |
| (file body) | binary | Yes | No | The DNS application zip file data in binary format, sent as multipart form data in the request body. |
## Response Fields
| response.updatedApp | object | The updated app object. |
| response.updatedApp.name | string | Name of the updated app. |
| response.updatedApp.version | string | Version string of the updated app. |
| response.updatedApp.dnsApps | array | Array of DNS app class entries within this app. |
| response.updatedApp.dnsApps[].classPath | string | The fully qualified class path of the DNS app. |
| response.updatedApp.dnsApps[].description | string | Human-readable description of what the DNS app does. |
| response.updatedApp.dnsApps[].isAppRecordRequestHandler | bool | Whether this app handles APP record requests. |
| response.updatedApp.dnsApps[].recordDataTemplate | string or null | Template for APP record data. Only present when `isAppRecordRequestHandler` is true. |
| response.updatedApp.dnsApps[].isRequestController | bool | Whether this app acts as a request controller. |
| response.updatedApp.dnsApps[].isAuthoritativeRequestHandler | bool | Whether this app handles authoritative requests. |
| response.updatedApp.dnsApps[].isRequestBlockingHandler | bool | Whether this app handles request blocking. |
| response.updatedApp.dnsApps[].isQueryLogger | bool | Whether this app acts as a query logger. |
| response.updatedApp.dnsApps[].isPostProcessor | bool | Whether this app acts as a post processor. |
## Conditional Logic Notes
- The app identified by `name` must already be installed on the server. This endpoint updates an existing app.
- Unlike `downloadAndUpdate`, this endpoint does NOT download the zip from a URL. The zip file is uploaded directly in the request body.
- Despite being a "Delete" permission level, this endpoint updates apps. The permission model uses "Delete" as the highest privilege tier for app management.
## Edge Cases
- **This is a multipart form data POST request.** The request body must contain the DNS application zip file in binary format as multipart form data. This is different from most other API calls which use GET with query parameters.
- The `token` and `name` parameters are passed as URL query parameters, not in the multipart body.
- The docs do not specify the form field name for the file upload. Implementation should test with common field names (e.g., `fileData`, `file`).
- The response key is `updatedApp` (not `installedApp` as in the install endpoint).