Update an existing URL’s properties.
Partially update a shortened URL. Only provided fields are modified; omitted
fields remain unchanged. Pass null to remove optional settings like
password, max_clicks, or expire_after.
Authentication: Required — you must own the URL.
API Key Scope: urls:manage or admin:all
Rate Limits: 120/min, 2,000/day
Updatable Fields: long_url, alias, password, block_bots,
max_clicks, expire_after, private_stats, status
Notes:
max_clicks to 0 or null removes the click limitalias checks availability and may fail with 409 Conflicturl_id is the MongoDB ObjectId, not the aliasAPI key authentication. Pass your key as: Bearer spoo_<your_key>
Unique identifier of the URL
Request body for partially updating an existing shortened URL.
All fields are optional; only provided fields are updated.
Pass max_clicks=0 or max_clicks=null to remove the limit.
Pass password=null (or omit) to remove password protection.
New destination URL. Must be a valid http:// or https:// URL.
"https://example.com/updated/url"
New custom short code. Pass null to keep existing. Must be unique and available.
"newlink"
New password. Pass null to remove password protection.
"newPass@456"
Block known bot user agents. Pass null to keep existing setting.
New click limit. Pass 0 or null to remove the limit.
x >= 0500
Expiration time. ISO 8601 string (e.g. 2025-12-31T23:59:59Z) or Unix epoch seconds (e.g. 1735689599). Pass null to remove.
"2025-12-31T23:59:59Z"
Make statistics private (only owner can view). Pass null to keep existing.
URL status. ACTIVE enables redirects, INACTIVE disables them.
ACTIVE, INACTIVE "ACTIVE"
Successful Response
Response body after a successful URL update (PATCH /api/v1/urls/{url_id}).
MongoDB ObjectId of the URL.
"507f1f77bcf86cd799439011"
Whether the URL is password-protected.
Last update time as Unix timestamp.
1704067200
Short code.
"mylink"
Destination URL.
"https://example.com/long/url"
URL status.
"ACTIVE"
Click limit, or null if unlimited.
100
Expiration as Unix timestamp, or null.
1735689599
Whether bot blocking is enabled.
Whether statistics are private.