Update a promo code (PATCH)

PATCH/v1/organization/{orgId}/awards/programs/{programId}/promo-codes/{promoCodeId}

US Region: https://public-api.sessionboard.com · EU Region: https://public-api-eu.sessionboard.com

Renaming to a code already used in the program returns 409. PUT and PATCH behave the same: send only the fields you are changing. Requires the write:awards scope.

Request example

cURL

curl --request PATCH \
  --url 'https://public-api.sessionboard.com/v1/organization/{orgId}/awards/programs/{programId}/promo-codes/{promoCodeId}' \
  --header 'x-access-token: <api-token>' \
  --header 'Content-Type: application/json' \
  --data '{
  "code": "<string>",
  "type": "percentage",
  "amount": 0,
  "starts_at": "2026-01-15T09:30:00Z",
  "ends_at": "2026-01-15T09:30:00Z"
}'

JavaScript

const response = await fetch('https://public-api.sessionboard.com/v1/organization/{orgId}/awards/programs/{programId}/promo-codes/{promoCodeId}', {
  method: 'PATCH',
  headers: {
    "x-access-token": "<api-token>",
    "Content-Type": "application/json"
  },
  body: JSON.stringify({
    "code": "<string>",
    "type": "percentage",
    "amount": 0,
    "starts_at": "2026-01-15T09:30:00Z",
    "ends_at": "2026-01-15T09:30:00Z"
  }),
});

const data = await response.json();
console.log(data);

Python

import requests

response = requests.request(
    "PATCH",
    "https://public-api.sessionboard.com/v1/organization/{orgId}/awards/programs/{programId}/promo-codes/{promoCodeId}",
    headers={
        "x-access-token": "<api-token>",
        "Content-Type": "application/json"
    },
    json={
        "code": "<string>",
        "type": "percentage",
        "amount": 0,
        "starts_at": "2026-01-15T09:30:00Z",
        "ends_at": "2026-01-15T09:30:00Z"
    },
)

print(response.json())

PHP

<?php

$curl = curl_init();

curl_setopt_array($curl, [
    CURLOPT_URL => "https://public-api.sessionboard.com/v1/organization/{orgId}/awards/programs/{programId}/promo-codes/{promoCodeId}",
    CURLOPT_RETURNTRANSFER => true,
    CURLOPT_CUSTOMREQUEST => "PATCH",
    CURLOPT_POSTFIELDS => '{
  "code": "<string>",
  "type": "percentage",
  "amount": 0,
  "starts_at": "2026-01-15T09:30:00Z",
  "ends_at": "2026-01-15T09:30:00Z"
}',
    CURLOPT_HTTPHEADER => [
        "x-access-token: <api-token>",
        "Content-Type: application/json",
    ],
]);

$response = curl_exec($curl);
curl_close($curl);

echo $response;

Go

package main

import (
  "fmt"
  "io"
  "net/http"
  "strings"
)

func main() {
  req, _ := http.NewRequest("PATCH", "https://public-api.sessionboard.com/v1/organization/{orgId}/awards/programs/{programId}/promo-codes/{promoCodeId}", strings.NewReader(`{
  "code": "<string>",
  "type": "percentage",
  "amount": 0,
  "starts_at": "2026-01-15T09:30:00Z",
  "ends_at": "2026-01-15T09:30:00Z"
}`))
  req.Header.Add("x-access-token", "<api-token>")
  req.Header.Add("Content-Type", "application/json")

  res, _ := http.DefaultClient.Do(req)
  defer res.Body.Close()
  body, _ := io.ReadAll(res.Body)

  fmt.Println(string(body))
}

Java

HttpRequest request = HttpRequest.newBuilder()
    .uri(URI.create("https://public-api.sessionboard.com/v1/organization/{orgId}/awards/programs/{programId}/promo-codes/{promoCodeId}"))
    .header("x-access-token", "<api-token>")
    .header("Content-Type", "application/json")
    .method("PATCH", HttpRequest.BodyPublishers.ofString("{\n  \"code\": \"<string>\",\n  \"type\": \"percentage\",\n  \"amount\": 0,\n  \"starts_at\": \"2026-01-15T09:30:00Z\",\n  \"ends_at\": \"2026-01-15T09:30:00Z\"\n}"))
    .build();

HttpResponse<String> response = HttpClient.newHttpClient()
    .send(request, HttpResponse.BodyHandlers.ofString());

System.out.println(response.body());

Try it

RegionUS Region — https://public-api.sessionboard.comEU Region — https://public-api-eu.sessionboard.com

Authorization

Send asAPI token (x-access-token)OAuth access token (Bearer)

Token

Your token stays in this page. It is sent only to the region above and is never saved; it is gone when you leave or reload the page.

Path parameters

orgId*

programId*

promoCodeId*

Body application/json

{ "code": "<string>", "type": "percentage", "amount": 0, "starts_at": "2026-01-15T09:30:00Z", "ends_at": "2026-01-15T09:30:00Z" }

PATCH

Send request

Authorizations

• x-access-tokenstringheader

  Organization API token. Generate from Organization Settings → API Tokens.

• AuthorizationBearer <token>headeror

  OAuth 2.1 access token. Obtained via the OAuth PKCE flow at /oauth/token.

Send one of these. See Authentication.

Path parameters

• orgIdstringpathrequired

  Your organization ID. Any other organization returns 404.

• programIdstring<uuid>pathrequired

  The Awards program ID.

• promoCodeIdstring<uuid>pathrequired

  The promo code ID.

Request body

application/jsonrequired

• codestring

  Letters and digits; stored upper-case.

  Max length

  255

  Pattern

  ^[A-Za-z0-9]+$

• typestring

  Allowed values

  "percentage", "flat"

• amountnumber

  Percent off (at most 100) or a flat amount in the program's currency.

  Minimum

  0

• starts_atstring<date-time> | null
• ends_atstring<date-time> | null

Example

{
  "code": "<string>",
  "type": "percentage",
  "amount": 0,
  "starts_at": "2026-01-15T09:30:00Z",
  "ends_at": "2026-01-15T09:30:00Z"
}

Responses

200application/json

Promo code updated

• dataAwardsPromoCode
  Show child attributes

  • idstring<uuid>
  • program_idstring<uuid>
  • codestring
  • typestring

    Allowed values

    "percentage", "flat"

  • amountnumber
  • starts_atstring<date-time> | null
  • ends_atstring<date-time> | null
  • redemption_countinteger

    Submissions the code has been applied to. Returned by the single-code GET only.

  • created_atstring<date-time>
  • updated_atstring<date-time>

400application/json

Invalid body or id

• errorstring

  Allowed values

  "VALIDATION_ERROR", "SCOPE_REQUIRED", "FORBIDDEN", "NOT_FOUND", "CONFLICT"

• messagestring

401

Missing or invalid token

403application/json

Token lacks write:awards

• errorstring

  Allowed values

  "VALIDATION_ERROR", "SCOPE_REQUIRED", "FORBIDDEN", "NOT_FOUND", "CONFLICT"

• messagestring

404application/json

Not found — also returned for any id belonging to another organization

• errorstring

  Allowed values

  "VALIDATION_ERROR", "SCOPE_REQUIRED", "FORBIDDEN", "NOT_FOUND", "CONFLICT"

• messagestring

409application/json

Promo code SAVE20 already exists in this program

• errorstring

  Allowed values

  "VALIDATION_ERROR", "SCOPE_REQUIRED", "FORBIDDEN", "NOT_FOUND", "CONFLICT"

• messagestring

Response examples

200

{
  "data": {
    "id": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
    "program_id": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
    "code": "SAVE20",
    "type": "percentage",
    "amount": 20,
    "starts_at": "2026-01-15T09:30:00Z",
    "ends_at": "2026-01-15T09:30:00Z",
    "redemption_count": 123,
    "created_at": "2026-01-15T09:30:00Z",
    "updated_at": "2026-01-15T09:30:00Z"
  }
}

400

{
  "error": "VALIDATION_ERROR",
  "message": "\"name\" is not allowed to be empty"
}

403

{
  "error": "SCOPE_REQUIRED",
  "message": "Token missing required scope: write:awards"
}

404

{
  "error": "NOT_FOUND",
  "message": "Not found"
}

409

{
  "error": "CONFLICT",
  "message": "Promo code SAVE20 already exists in this program"
}