POST /api/v1/cloud/sessions/{session_id}
This endpoint updates a Session that has already been created. It can update top-level Session attributes such as title, metadata, and environment_variables, or dynamically change the model, system prompt, tools, MCP servers, Skill bindings, and other runtime configuration through the agent object. Omitted fields are preserved.
Updating an Agent or publishing a new Agent version does not automatically change existing Sessions. A Session pins a runtime configuration snapshot when it is created. A Skill binding pinned to a numeric version also remains on that version when a new Skill version is published. To apply these changes to an existing Session, call this endpoint explicitly for that Session and submit the corresponding agent fields.
Path parameters
| Parameter | Type | Description |
|---|
session_id | string | Session ID with the sess_ prefix |
| Header | Required | Description |
|---|
Authorization | Yes | Bearer $QODER_ACCESS_TOKEN |
Content-Type | Yes | application/json |
x-qoder-beta | For Beta Agent fields | Include session-agent-patch-2026-07-21 when updating agent.model, agent.system, agent.skills, agent.name, or agent.description |
x-qoder-beta | When using Browser Use | Include browser-use-2026-07-14 when agent.tools contains browser_toolset_20260714. See Browser Use (Beta) |
When both Beta IDs are required, send them as one comma-separated header:
x-qoder-beta: session-agent-patch-2026-07-21, browser-use-2026-07-14
Request body
Regular Session attributes and agent runtime configuration can be submitted in the same request. A combined update succeeds or fails as a unit in one row-locked transaction.
| Field | Type | Required | Description |
|---|
budget | object | null | No | Total session budget (model and sandbox credits), e.g. {"type":"limit","max_credit_cost":"100.00"}. Omit it to keep the current setting; pass null to remove the limit. See Session budget. |
title | string | null | No | New Session title. Send null to clear it |
metadata | object | null | No | Metadata patch. Object keys with null values delete those keys; top-level null is a no-op |
environment_variables | object | null | No | Replaces the Session-supplied environment-variable map. Omitted keys are removed; {} or null clears the Session-supplied values. Environment-variable credentials from existing Vaults are merged again, with explicitly supplied Session values taking precedence. Uses the create-time validation rules |
agent | object | No | Dynamically updates the embedded runtime snapshot for this Session. The object must contain at least one supported field described below |
Update regular Session attributes
Session updates do not use a version field. Concurrent metadata patches merge against the latest locked value; concurrent updates to title or environment_variables use last-write-wins semantics.
curl -X POST "https://api.qoder.com/api/v1/cloud/sessions/sess_019e3bb1e8c171fd9abbb1477ffb84cc" \
-H "Authorization: Bearer $QODER_ACCESS_TOKEN" \
-H "Content-Type: application/json" \
-d '{
"title": "New title",
"metadata": {
"priority": "high",
"old_key": null
},
"environment_variables": {
"LOG_LEVEL": "debug"
}
}'
Dynamically update runtime configuration
Although the request uses an agent object, the operation covers all supported Session runtime settings inside that snapshot, including skills. It patches concrete configuration fields for the current Session; it does not switch the Session to an Agent ID or version. Do not send agent.id or agent.version.
Update Agent/config ──> Agent version N+1 ──╳──> existing Session snapshot N
Publish Skill S+1 ──────────────────────────╳──> binding pinned to Skill S
│
POST /sessions/{session_id} with agent fields ───────┘
│
└──> updated runtime snapshot for subsequent turns
Apply newly published Agent configuration
- Update the source Agent, which publishes a new Agent version.
- Get the desired Agent version and read its configuration.
- Copy only the supported fields from that Agent into the
agent patch object. Do not copy the full Agent response because fields such as id, type, version, metadata, and multiagent are not accepted here.
- Call this endpoint once for each existing Session that should use the new configuration.
- Confirm the returned Session contains the expected embedded
agent, then start the next turn.
New Sessions created from the updated Agent pin the new Agent version normally. Only Sessions that already existed need this explicit dynamic update.
Skill version behavior
- A numeric
skills[].version pins that exact Skill version. Publishing a newer Skill version does not affect the existing Session. Submit agent.skills with the new numeric version to move the Session forward.
- An omitted
version or the string "latest" dynamically follows the newest Skill version at sandbox preparation time. You do not need to update the Session only to advance Skill content in this case.
- Changing the Skill binding list itself—for example, adding, removing, or replacing a Skill—always requires an explicit
agent.skills update for an existing Session.
A dynamic update creates a Session-local runtime snapshot that can differ from the published Agent and Skill versions. It does not advance the embedded agent.version; verify the concrete configuration fields in the Session response instead of using that value to determine whether the update took effect.
Updatable fields in agent
| Field | Type | Beta header | Semantics |
|---|
model | string | Agent model | session-agent-patch-2026-07-21 | Replaces the model selection after validating it against the caller's model catalog |
system | string | session-agent-patch-2026-07-21 | Replaces the system prompt |
tools | array of Agent tool | Not required, except for Browser Use | Replaces the complete tool configuration. Maximum 128 entries |
mcp_servers | array of MCP server | Not required | Replaces the complete MCP server list. Maximum 20 entries |
skills | array of Skill binding | session-agent-patch-2026-07-21 | Replaces the complete Skill binding list. Maximum 20 entries |
name | string | session-agent-patch-2026-07-21 | Replaces the name in the embedded Agent snapshot |
description | string | session-agent-patch-2026-07-21 | Replaces the description in the embedded Agent snapshot |
The following Agent fields cannot be updated through this endpoint:
| Field | Behavior |
|---|
id, version, type | Rejected as unknown fields. This endpoint does not repin the Session by Agent reference |
multiagent | Rejected. The coordinator roster is not dynamically writable |
Agent metadata | Rejected. To update Session-level metadata, use the top-level metadata field in the request body |
| Any other Agent field | Rejected instead of ignored |
Runtime configuration update semantics
- Omitted
agent fields keep their current values.
tools, mcp_servers, and skills are complete replacements. Include every entry you want to keep, or send [] to clear the field.
- When changing both
tools and mcp_servers, submit both complete arrays in the same request. Every mcp_toolset entry must reference a name in the effective mcp_servers list.
- Changing
mcp_servers, or changing tools when the Session has MCP servers, reruns MCP discovery and refreshes the tools frozen into the Session snapshot.
- A single MCP server discovery failure does not reject the update. The API still returns
200 and emits a session.error event. Invalid request configuration or an internal snapshot/freezing failure rejects the request.
- Dynamic runtime updates do not use optimistic concurrency control. Concurrent successful updates use last-write-wins semantics.
- Archived or terminated Sessions cannot receive dynamic runtime updates.
When changes take effect
The updated Agent snapshot is saved on the Session and its coordinator thread. Subsequent turns use the updated snapshot. A turn that was already dispatched before the update may continue using its previous configuration; wait for the Session to become idle before updating when you need a clean turn boundary.
Example: apply new model, prompt, and Skill configuration
Because skills is a complete replacement, include every Skill binding the Session should keep.
curl -X POST "https://api.qoder.com/api/v1/cloud/sessions/sess_019e3bb1e8c171fd9abbb1477ffb84cc" \
-H "Authorization: Bearer $QODER_ACCESS_TOKEN" \
-H "Content-Type: application/json" \
-H "x-qoder-beta: session-agent-patch-2026-07-21" \
-d '{
"agent": {
"model": {
"id": "ultimate",
"effort": "high",
"context_window": 200000
},
"system": "Use the latest review policy and cite evidence for every conclusion.",
"skills": [
{
"type": "custom",
"skill_id": "skill_019e3bba474b73cfaf19eae9b5f5e66d",
"version": "1759264410332875"
}
]
}
}'
tools and mcp_servers do not require the Session Agent Patch Beta ID. Both arrays are complete replacements.
curl -X POST "https://api.qoder.com/api/v1/cloud/sessions/sess_019e3bb1e8c171fd9abbb1477ffb84cc" \
-H "Authorization: Bearer $QODER_ACCESS_TOKEN" \
-H "Content-Type: application/json" \
-d '{
"agent": {
"tools": [
{
"type": "mcp_toolset",
"mcp_server_name": "docs"
}
],
"mcp_servers": [
{
"name": "docs",
"type": "url",
"url": "https://mcp.example.com/mcp"
}
]
}
}'
Response and events
HTTP 200 OK
Returns the updated Session object. A dynamic runtime update advances neither the source Agent's version nor the Session snapshot's embedded agent.version.
A successful update emits session.updated. The event always contains id, type, and processed_at; depending on the update, it also contains title, metadata, or the complete updated agent snapshot. Environment-variable values are never included. An update that changes only environment_variables emits only the fixed fields. See Session schemas for the complete event schema.
If MCP discovery fails for an individual server, the service additionally emits session.error while retaining the successful update.
Errors
| HTTP | Type | Trigger |
|---|
| 400 | invalid_request_error | Malformed request body, unknown field, or invalid attribute value |
| 400 | invalid_request_error | The agent object contains an unsupported field, or its model, tool, MCP server, Skill, or cross-field configuration is invalid |
| 400 | invalid_request_error | A Beta Agent field is supplied without session-agent-patch-2026-07-21 |
| 400 | invalid_request_error | agent.tools contains browser_toolset_20260714 without the Browser Use Beta ID |
| 400 | invalid_request_error | The Session is archived or terminated and the request updates runtime configuration |
| 401 | authentication_error | PAT or SAT invalid or expired |
| 404 | not_found_error | Session does not exist, or an ordinary attribute update targets an archived Session |
| 409 | invalid_request_error | The Session is archived concurrently while the update is being committed |
| 500 | api_error | Existing Vault environment-variable credentials could not be resolved safely |
| 503 | feature_not_available | Browser Use is temporarily unavailable |
| 503 | api_error | The model catalog or another required dependency is temporarily unavailable |
See Errors for the full error envelope.