# Update a workflow a workspace manages

> Change a workflow a workspace manages: its source, mode, repositories or visibility; fields left out stay as they are.

<div class="g1t-endpoint"><span class="g1t-method" data-method="patch">PATCH</span><code>/workspaces/{workspace}/actions/managed-workflows/{workflow}</code></div>

Giving source, or refresh: true, copies the source again at the commit its ref names now. Owners only. Returns the workflow.

refresh copies the source again at the commit its ref names now. Fields left out stay as they are.

- **Authentication:** Required. Send an [access token](/reference/api/#authentication) as `Authorization: Bearer`.
- **MCP tool:** [`workflow`](/reference/mcp/#workflow) with `action` `update_managed_workflow`, and the same inputs
- **Scope:** An access token needs [`workspace:admin`](/guides/authentication/#scopes).

## Path parameters

| Name | Type | Required | Description |
| --- | --- | --- | --- |
| `workspace` | string | Yes | The workspace's name, e.g. "acme". |
| `workflow` | string | Yes | The managed workflow's name, as in managed/&lt;name>.yml. |

## Body parameters

Send a JSON object. Names are `snake_case`, as in responses; the `camelCase` spelling is accepted too.

| Name | Type | Required | Description |
| --- | --- | --- | --- |
| `source` | string | No | A workflow file in one of the workspace's repositories: owner/repo/.g1t/workflows/file.yml@ref. |
| `mode` | string | No | required: a repository cannot take its place or turn it off. default: a repository's workflow of the same name takes its place. One of `required`, `default`. |
| `repositories` | array of strings | No | Repository names and patterns (* matches any characters, ! excludes); empty is every repository. |
| `visibility` | string | No | Which repositories, by visibility. A private source needs private. One of `all`, `public`, `private`. |
| `refresh` | boolean | No | Copy the source again, at the commit its ref names now. |

## Example request

```sh
curl -X PATCH https://api.g1t.sh/workspaces/flagon-io/actions/managed-workflows/security-scan \
  -H "Authorization: Bearer $G1T_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{
    "refresh": true
  }'
```

## Example response

A successful request answers `200` with:

```json
{
  "name": "security-scan",
  "path": "managed/security-scan.yml",
  "workflow_name": "Security scan",
  "source": "flagon-io/policies/.g1t/workflows/security-scan.yml@main",
  "source_sha": "4f1c2a9e0b7d3c5a8e6f1b2d4c7a9e0f3b5d8c1a",
  "source_private": false,
  "mode": "required",
  "repositories": [
    "*",
    "!sandbox-*"
  ],
  "visibility": "all",
  "content": "name: Security scan\non: [push, pull_request]\njobs:\n  scan:\n    runs-on: ubuntu-latest\n    steps:\n      - uses: actions/checkout@v4\n      - run: ./scripts/scan.sh\n",
  "created_at": "2026-10-12T09:30:00Z",
  "updated_at": "2026-10-12T09:30:00Z",
  "updated_by": "ada"
}
```

## Errors

A failed request answers with one of these statuses and a body like `{"error": {"code": "not_found", "message": "Repository not found."}}`. See [errors](/reference/api/#errors).

| Status | Code | When |
| --- | --- | --- |
| 401 | `unauthenticated` | A token is required, or the one sent is not valid. |
| 403 | `forbidden` | The token is valid but not allowed to do this, such as a member-only change, or a token without the scope it needs. |
| 404 | `not_found` | It does not exist, or you cannot see it. |
| 409 | `conflict` | The request conflicts with the current state. |
| 422 | `invalid` | The input is not valid. `message` says which field and why. |