# Update a plugin

> Update an installed plugin by ref: read it again at the commit its marketplace now lists and pin it there.

<div class="g1t-endpoint"><span class="g1t-method" data-method="post">POST</span><code>/workspaces/{workspace}/customize/plugins/{ref}/update</code></div>

Its skills get new versions and keep their attachments, skills it no longer has are archived, its agent templates and components are rewritten, and a server it already brought keeps its connector; new remote servers become connectors. A plugin already at its marketplace's commit comes back unchanged. [`list_plugins`](/reference/api/customize/list-plugins/) shows `update` when there is one to take. Owners only. Recorded in the audit log.

The plugin is read again at the commit its marketplace lists now and pinned there: its skills get new versions (agents and teams that had them keep them), skills it no longer has are archived, its templates and `components` are rewritten, and a server it already brought keeps its connector. A plugin already at that commit comes back as it was. Runners fetch the new commit from the next run on.

- **Authentication:** Required. Send an [access token](/reference/api/#authentication) as `Authorization: Bearer`.
- **MCP tool:** [`customize`](/reference/mcp/#customize) with `action` `update_plugin`, and the same inputs
- **Scope:** An access token needs [`workspace:admin`](/guides/authentication/#scopes).

## Path parameters

| Name | Type | Required | Description |
| --- | --- | --- | --- |
| `workspace` | string | Yes | The workspace's slug. |
| `ref` | string | Yes | The plugin as name@marketplace, such as commit-commands@claude-plugins-official. |

## Example request

```sh
curl -X POST https://api.g1t.sh/workspaces/flagon-io/customize/plugins/commit-commands%2540claude-plugins-official/update \
  -H "Authorization: Bearer $G1T_TOKEN"
```

## Example response

A successful request answers `200` with:

```json
{
  "id": "plg_01kq9f2h4k6m8p0r2t4v6x8z0b",
  "ref": "commit-commands@claude-plugins-official",
  "name": "commit-commands",
  "marketplace": "claude-plugins-official",
  "display_name": "Commit commands",
  "description": "Commands for committing, pushing and opening pull requests.",
  "version": "1.1.0",
  "sha": "e3b5d7f90a1c3e5b7d9f1a3c5e7b9d1f3a5c7e9b",
  "fetch": {
    "kind": "github",
    "repo": "anthropics/claude-plugins-official",
    "ref": null,
    "sha": "e3b5d7f90a1c3e5b7d9f1a3c5e7b9d1f3a5c7e9b",
    "path": "plugins/commit-commands"
  },
  "components": {
    "skills": [],
    "agents": [],
    "commands": [
      {
        "name": "commit",
        "path": "commands/commit.md"
      },
      {
        "name": "commit-push-pr",
        "path": "commands/commit-push-pr.md"
      },
      {
        "name": "clean-gone",
        "path": "commands/clean-gone.md"
      }
    ],
    "mcp_servers": [],
    "hooks": false,
    "lsp": false,
    "bin": false,
    "output_styles": false
  },
  "problems": [],
  "enabled": true,
  "installed_by": "syntaqx",
  "installed_at": "2026-10-10T09:14:52.207Z",
  "update": null
}
```

## Errors

A failed request answers with one of these statuses and a body like `{"error": {"code": "not_found", "message": "Repository not found."}}`. See [errors](/reference/api/#errors).

| Status | Code | When |
| --- | --- | --- |
| 401 | `unauthenticated` | A token is required, or the one sent is not valid. |
| 403 | `forbidden` | The token is valid but not allowed to do this, such as a member-only change or an agent token outside its repository. |
| 404 | `not_found` | It does not exist, or you cannot see it. |
| 409 | `conflict` | The request conflicts with the current state. |
| 422 | `invalid` | The input is not valid. `message` says which field and why. |