Update an advertisement

patch/v1/advertisements/{advertisement_id}

This endpoint is in the contract, but the API doesn't serve it during early access. It returns 404 for now.

Partial update. The permission depends on the fields sent: base fields need advertisementEdit; client_id also needs advertisementAssignClients; tags also needs advertisementAssignTags.

curl -X PATCH "https://api.vojo-media.com/v1/advertisements/$ADVERTISEMENT_ID" \
  -H "Authorization: Bearer $VOJO_KEY" \
  -H "Content-Type: application/json" \
  -d '{
  "name": "Acme Summer 15s (v2)",
  "tags": [
    "summer"
  ]
}'

const { data, error } = await api.PATCH("/v1/advertisements/{advertisement_id}", {
  params: { path: { advertisement_id: advertisementId } },
  body: {
    name: "Acme Summer 15s (v2)",
    tags: [
      "summer",
    ],
  },
});
if (error) throw new VojoApiError(error);

Response 200

{
  "data": {
    "id": "cm1adv3z7x0001c5v9b2n6m4tm",
    "name": "Acme Summer 15s",
    "description": "Portrait cut",
    "type": "video",
    "client_id": "cm1cli6x2v0001n4b8m3q7w9rk",
    "is_active": true,
    "size_bytes": 18874368,
    "length": 15,
    "thumbnail_url": "https://cdn.vojo-media.com/thumbs/cm1adv3z7x0001c5v9b2n6m4tm.jpg",
    "source_url": "https://spaces.vojo-media.com/cm1org8k2q0001x7v3n9p4d2fa/9b1e.mp4?X-Amz-Expires=900&X-Amz-Signature=4f0c2a9d",
    "tags": [
      "summer",
      "portrait"
    ],
    "uploaded_by_user_id": "cm1usr3h7t0001k2m8q4w6z9ab",
    "created_at": "2026-09-14T08:12:45Z",
    "updated_at": "2026-10-07T09:30:00Z"
  },
  "meta": {}
}

Access

Authentication: Secret key or OAuth access token.
Scope: advertisements:write
User permission: advertisementEdit
Sending client_id: Also needs advertisementAssignClients
Sending tags: Also needs advertisementAssignTags

Path parameters

advertisement_idstringRequired
Advertisement id.

Headers

Vojo-Organisationstring
The organisation this request acts on (org id). Required for oauth2 callers — a missing header returns 400 organisation_header_required; an org the user cannot access (a membership or an access grant, and granted to this OAuth client) returns 403 organisation_access_denied. Secret keys are bound to one org: the header may be omitted, and if sent it must match the key's org (else 403). Every query is scoped by the resolved org, never by an id in the body.
Vojo-Versionstring
Optional API version pin (a date). Overrides the version pinned on the secret key / organisation for this request. Echoed in the Vojo-Version response header. Within /v1 only additive changes ship, so most callers can omit it.
date

Request body

at least 1 field

namestring
1 to 120 characters
descriptionstring or null
up to 100 characters
client_idstring or null
Requires advertisementAssignClients. Null unassigns.
tagsarray of string
Replaces the tag set. Requires advertisementAssignTags.
up to 50 items, each 1 to 60 characters

Response 200

dataobjectRequired
An uploaded creative.
Show 14 fields
- idstringRequired
  Advertisement id. Opaque string — treat as an identifier, never parse it.
- namestringRequired
- descriptionstring or nullRequired
  up to 100 characters
- typestringRequired
  Creative media type.
  One of video, image, html
- client_idstring or nullRequired
- is_activebooleanRequired
  False once archived via DELETE.
- size_bytesinteger or nullRequired
  Measured from storage (HeadObject); never client-supplied.
- lengthnumber or nullRequired
  Duration in seconds (video/HTML).
- thumbnail_urlstring or nullRequired
  uri
- source_urlstring or nullRequired
  Short-lived signed GET URL for the media. Present only when the caller has advertisementViewSource; otherwise null.
  uri
- tagsarray of stringRequired
- uploaded_by_user_idstringRequired
  The person who uploaded it (for a secret key, the key's creator).
- created_atstringRequired
  RFC 3339 / ISO-8601 UTC timestamp.
  date-time
- updated_atstring or nullRequired
  RFC 3339 / ISO-8601 UTC timestamp, or null.
  date-time
metaobjectRequired
Response metadata for single-resource responses. Reserved; currently empty. Clients must ignore unknown members.

Response headers

Vojo-Versionstring
The API version (date) this response was rendered with — the request's Vojo-Version, else the key/org pin.
RateLimitstring
IETF RateLimit header: remaining quota in the current window, e.g. "default";r=97;t=42.
RateLimit-Policystring
IETF RateLimit-Policy header, e.g. "default";q=100;w=60. Portal OAuth clients get a higher tier.

Errors

Every error is application/problem+json. Branch on its code.

400
Malformed request: invalid JSON, a bad cursor, a missing Vojo-Organisation for an OAuth caller, or an unknown Vojo-Version.
401
Missing, invalid, expired or revoked credential.
403
The caller is authenticated but not allowed: missing scope (insufficient_scope), missing Permissions flag (permission_denied), a client/installer persona on an operator endpoint (operator_access_required), or no access to the requested org (organisation_access_denied).
404
The resource does not exist, or belongs to another organisation. Cross-org ids always 404, never 403.
422
Well-formed request that failed validation. errors[] lists each failing field.
429
Rate limit exceeded for this principal. Back off for Retry-After seconds.
500
Unexpected server failure.