> ## Documentation Index > Fetch the complete documentation index at: https://docs.flashduty.com/llms.txt > Use this file to discover all available pages before exploring further. # Update remote config > Publish a complete new remote configuration version for a RUM application. ## Restrictions | Aspect | Value | | ----------- | ----------------------------------------------------------- | | Rate limits | **300 requests/minute**; **20 requests/second** per account | | Permissions | **Applications Manage** (`rum`) | ## Usage * The client sends the complete object, not a patch: rule order is the priority, so a partial update has no unambiguous interpretation. * Each call allocates a new version and records a history row in the same transaction as the write. * Call `POST /rum/application/remote-config/preview` first to check what clients would receive. ## OpenAPI ````yaml /api-reference/rum.openapi.en.json post /rum/application/remote-config/update openapi: 3.1.0 info: description: >- Public HTTP API for the Flashduty incident management platform — incidents, notification templates, channels, schedules, monitors, RUM, and platform administration. Every operation is authenticated with an `app_key` query parameter issued from the Flashduty console under Account → APP Keys. Responses follow a uniform envelope: `{ request_id, data }` on success, `{ request_id, error }` on failure. title: Flashduty Open API version: 1.0.0 servers: - description: Flashduty Open API url: https://api.flashcat.cloud security: - AppKeyAuth: [] tags: - description: Manage Real User Monitoring (RUM) applications. name: RUM/Applications - description: Run RUM analytics queries over event data. name: RUM/Data query - description: Query and manage RUM error tracking issues and preset severity rules. name: RUM/Issues - description: >- Query RUM facet fields and their value distributions for building analytics filters. name: RUM/Facets - description: >- Manage and query RUM sourcemap files for browser, Android, and iOS error symbolication. name: RUM/Sourcemaps - description: Retrieve session replay metadata and recorded segments for RUM sessions. name: RUM/Session replay - description: >- Configure and inspect the rules that decide which RUM errors get ingested and stored for an application, including their edit history. name: RUM/Error ingestion rules - description: >- Manage per-application rules that assign a severity to matching front-end errors, plus their evaluation order and change history. name: RUM/Issue preset severity rules - description: Query the RUM resource record and current usage for the account. name: RUM/Resources paths: /rum/application/remote-config/update: post: tags: - RUM/Applications summary: Update remote config description: >- Publish a complete new remote configuration version for a RUM application. operationId: rum-application-remote-config-write-update requestBody: content: application/json: example: application_id: WoyQQ3BohkdtPivubEvE8o config: activation: next_session custom: feature_flags: checkout_v2: true default: defaultPrivacyLevel: mask-user-input sessionReplaySampleRate: 20 sessionSampleRate: 100 traceSampleRate: 100 enabled: true refresh_on_foreground: false rules: - match: env: production set: defaultPrivacyLevel: mask sessionReplaySampleRate: 0 sessionSampleRate: 5 reason: Tighten replay sampling for the Q4 launch schema: $ref: '#/components/schemas/UpdateRemoteConfigRequest' required: true responses: '200': content: application/json: example: data: version: 8 request_id: 01HK8XQE3Z7JM2NTFQ5YJ8P9R4 schema: allOf: - $ref: '#/components/schemas/SuccessEnvelope' - properties: data: $ref: '#/components/schemas/UpdateRemoteConfigResponse' type: object description: Success '400': $ref: '#/components/responses/BadRequest' '401': $ref: '#/components/responses/Unauthorized' '429': $ref: '#/components/responses/TooManyRequests' '500': $ref: '#/components/responses/ServerError' components: schemas: UpdateRemoteConfigRequest: description: >- Publish a whole new remote configuration version. The client sends the complete object, not a patch: rule order carries meaning. properties: application_id: description: RUM application ID. type: string config: $ref: '#/components/schemas/RemoteConfig' reason: description: Operator's note on why this version was published. Stored verbatim. maxLength: 255 type: string required: - application_id - config type: object SuccessEnvelope: description: >- Success response envelope. On every 2xx response, `request_id` identifies the call (also mirrored in the `Flashcat-Request-Id` header) and `data` holds the endpoint-specific payload. Failure responses use a different shape — see `ErrorResponse`. properties: data: description: Endpoint-specific payload. See each operation's 200 response schema. request_id: description: >- Unique ID for this request. Mirrored in the Flashcat-Request-Id response header. Include it when reporting issues. example: 01HK8XQE3Z7JM2NTFQ5YJ8P9R4 type: string required: - request_id - data type: object UpdateRemoteConfigResponse: description: Version allocated to the published configuration. properties: version: description: New published version number. type: integer type: object RemoteConfig: description: >- The whole per-application remote configuration. A change reaches an SDK asynchronously and is applied when that SDK creates its next session, so a running session never flips a decision mid-flight. properties: activation: default: next_session description: >- How a change lands on a client that is already running: `next_session` (the default, and what an empty value means) leaves running sessions untouched and applies the change to new sessions; `immediate` ends the running session as soon as the change arrives so a new session starts under the new configuration. enum: - next_session - immediate type: string custom: additionalProperties: {} description: >- Application-defined pass-through values handed to the host app verbatim. At most 5 keys, each key up to 64 bytes, each value up to 4 KB of JSON nested at most 3 levels, 16 KB in total. Anyone holding the public client token can read it. maxProperties: 5 type: object default: $ref: '#/components/schemas/RemoteConfigValues' enabled: description: >- Kill switch. When false the engine reports no values at all and SDKs fall back to their init values. type: boolean refresh_on_foreground: description: >- Let clients re-check the configuration when they return to the foreground instead of waiting for the next poll. type: boolean rules: description: Targeting rules, evaluated in order; at most 20 per application. items: $ref: '#/components/schemas/RemoteConfigRule' maxItems: 20 type: array type: object ErrorResponse: description: Response envelope for errors. `error` is required; `data` is absent. properties: error: $ref: '#/components/schemas/DutyError' request_id: description: >- Unique trace ID of this request; include it when reporting issues so logs can be located. example: 01HK8XQE3Z7JM2NTFQ5YJ8P9R4 type: string required: - request_id - error type: object RemoteConfigValues: description: >- The SDK knobs a configuration can set. Every field is optional: a value absent from both rule and default is omitted from the SDK response, which tells the SDK to keep its init value. properties: defaultPrivacyLevel: description: How Session Replay masks a page by default. enum: - mask - mask-user-input - allow type: - string - 'null' sessionReplaySampleRate: description: Session Replay sampling rate (0-100). maximum: 100 minimum: 0 type: - integer - 'null' sessionSampleRate: description: Session sampling rate (0-100). maximum: 100 minimum: 0 type: - integer - 'null' traceSampleRate: description: >- Trace sampling rate (0-100): which sessions inject trace headers into their requests. maximum: 100 minimum: 0 type: - integer - 'null' type: object RemoteConfigRule: description: >- One targeting rule: when `match` holds, `set` overrides `default`. The first matching rule wins and evaluation stops there - rule order is the priority. properties: match: additionalProperties: maxLength: 256 type: string description: >- Key/value conditions the SDK's config request must equal. Keys are limited to `env`, `app_version` and `sdk`; values are at most 256 bytes. minProperties: 1 type: object set: $ref: '#/components/schemas/RemoteConfigValues' required: - match - set type: object DutyError: description: >- Error payload inside the response envelope. Present only on non-2xx responses. properties: code: $ref: '#/components/schemas/ErrorCode' message: description: >- Human-readable error message, localized by the caller's Accept-Language. May contain field names, IDs, or other context from the failing request. example: The specified parameter template_id is not valid. type: string required: - code - message type: object ErrorCode: description: >- Flashduty error code enum. Every failed API response sets `error.code` to one of these stable wire strings. HTTP status is informational — the authoritative signal is the enum value. | Code | HTTP | Meaning | |---|---|---| | `OK` | 200 | Reserved — not returned on real errors. | | `InvalidParameter` | 400 | A required parameter is missing or failed validation. | | `BadRequest` | 400 | Generic 400 used when no more specific code fits. | | `InvalidContentType` | 400 | The `Content-Type` header is not `application/json`. | | `ResourceNotFound` | 400 | The referenced resource does not exist. Note: returned as HTTP 400, not 404 (historical choice). | | `NoLicense` | 400 | The feature is license-gated and no active license was found. | | `ReferenceExist` | 400 | Deletion blocked — other entities still reference this resource. | | `Unauthorized` | 401 | `app_key` is missing, invalid, or expired. | | `BalanceNotEnough` | 402 | Billing-gated operation with insufficient account balance. | | `AccessDenied` | 403 | Authenticated but lacking the permission required for this operation. | | `RouteNotFound` | 404 | The request URL path is not a known route. | | `MethodNotAllowed` | 405 | The HTTP method is not allowed on this otherwise-known path. | | `UndonedOrderExist` | 409 | An outstanding billing order blocks this new one. Wait and retry. | | `RequestLocked` | 423 | Operation temporarily locked due to repeated failures. | | `EntityTooLarge` | 413 | Request body exceeds the configured max size. | | `RequestTooFrequently` | 429 | Rate limit hit — API-global, per-account, or per-integration. | | `RequestVerifyRequired` | 428 | Second-factor verification required but not supplied. | | `DangerousOperation` | 428 | High-risk operation requires MFA verification. | | `InternalError` | 500 | Unhandled server-side error. Include `request_id` in the bug report. | | `ServiceUnavailable` | 503 | A backend dependency is unavailable. Try again later. | enum: - OK - InvalidParameter - BadRequest - InvalidContentType - ResourceNotFound - NoLicense - ReferenceExist - Unauthorized - BalanceNotEnough - AccessDenied - RouteNotFound - MethodNotAllowed - UndonedOrderExist - RequestLocked - EntityTooLarge - RequestTooFrequently - RequestVerifyRequired - DangerousOperation - InternalError - ServiceUnavailable example: InvalidParameter type: string x-enumDescriptions: AccessDenied: Authenticated but lacking the permission required for this operation. BadRequest: Generic 400 used when no more specific code fits. BalanceNotEnough: Billing-gated operation with insufficient account balance. DangerousOperation: High-risk operation requires MFA verification. EntityTooLarge: Request body exceeds the configured max size. InternalError: Unhandled server-side error. Include `request_id` in the bug report. InvalidContentType: The `Content-Type` header is not `application/json`. InvalidParameter: A required parameter is missing or failed validation. MethodNotAllowed: The HTTP method is not allowed on this otherwise-known path. NoLicense: The feature is license-gated and no active license was found. OK: Reserved — not returned on real errors. ReferenceExist: Deletion blocked — other entities still reference this resource. RequestLocked: Operation temporarily locked due to repeated failures. RequestTooFrequently: Rate limit hit — API-global, per-account, or per-integration. RequestVerifyRequired: Second-factor verification required but not supplied. ResourceNotFound: >- The referenced resource does not exist. Note: returned as HTTP 400, not 404 (historical choice). RouteNotFound: The request URL path is not a known route. ServiceUnavailable: A backend dependency is unavailable. Try again later. Unauthorized: '`app_key` is missing, invalid, or expired.' UndonedOrderExist: An outstanding billing order blocks this new one. Wait and retry. responses: BadRequest: content: application/json: examples: missingParameter: value: error: code: InvalidParameter message: The specified parameter is not valid. request_id: 01HK8XQE3Z7JM2NTFQ5YJ8P9R4 schema: $ref: '#/components/schemas/ErrorResponse' description: Invalid request — usually a missing or malformed parameter. Unauthorized: content: application/json: examples: missingAppKey: value: error: code: Unauthorized message: You are unauthorized. request_id: 01HK8XQE3Z7JM2NTFQ5YJ8P9R4 schema: $ref: '#/components/schemas/ErrorResponse' description: Missing or invalid app_key. TooManyRequests: content: application/json: examples: rateLimited: value: error: code: RequestTooFrequently message: Request too frequently. request_id: 01HK8XQE3Z7JM2NTFQ5YJ8P9R4 schema: $ref: '#/components/schemas/ErrorResponse' description: >- Rate limit hit. Either the global API limit, a per-account limit, or a per-integration limit. ServerError: content: application/json: examples: internal: value: error: code: InternalError message: >- We encountered an internal error, and it has been reported. Please try again later. request_id: 01HK8XQE3Z7JM2NTFQ5YJ8P9R4 schema: $ref: '#/components/schemas/ErrorResponse' description: Unexpected server-side error. Include the request_id when reporting. securitySchemes: AppKeyAuth: description: >- App key issued from the Flashduty console under Account → APP Keys. Required on every public API call. Keep it secret — it grants the same access as the owning account. in: query name: app_key type: apiKey ````