Update part of a RUM application: settings merge into the stored ones, unknown keys are a 400; privacy, retention and network body or header changes need an admin. Publishes.
const url = 'https://api.siteqwality.com/rum/2489E9AD-2EE2-8E00-8EC9-32D5F69181C0';const options = { method: 'PATCH', headers: {Authorization: 'Bearer <token>', 'Content-Type': 'application/json'}, body: '{"name":"example","domain":"example","settings":"example","allowed_origins":["example"],"replay_monthly_target":1}'};
try { const response = await fetch(url, options); const data = await response.json(); console.log(data);} catch (error) { console.error(error);}curl --request PATCH \ --url https://api.siteqwality.com/rum/2489E9AD-2EE2-8E00-8EC9-32D5F69181C0 \ --header 'Authorization: Bearer <token>' \ --header 'Content-Type: application/json' \ --data '{ "name": "example", "domain": "example", "settings": "example", "allowed_origins": [ "example" ], "replay_monthly_target": 1 }'Authorizations
Section titled “Authorizations ”Parameters
Section titled “ Parameters ”Path Parameters
Section titled “Path Parameters ”RUM application identifier
Request Body required
Section titled “Request Body required ”Body of PATCH /rum/{app_id}. Everything is optional; what is left out keeps its value.
object
null clears the domain; leaving the field out keeps it.
Any subset of the settings: objects merge, others replace, null sets a nullable key.
Unknown keys are a 400; privacy, retention and body or header capture need an admin.
Origins allowed to send data (https://app.example.com, https://*.example.com,
example.com), at most 100. Empty allows all.
Monthly replay target for Auto sampling; null clears it.
Example generated
{ "name": "example", "domain": "example", "settings": "example", "allowed_origins": [ "example" ], "replay_monthly_target": 1}Responses
Section titled “ Responses ”RUM application updated
object
object
object
Mask the value of every form input before it leaves the browser. Defaults to ON.
Mask all user-visible page text. Defaults to OFF: a replay with every text node masked is unreadable, so this is opt-in. Anything the page renders is therefore recorded verbatim unless the customer turns this on, and every document that describes replay has to say so.
Name clicks by tag and class only, never by element text. Defaults to OFF. When on, the ingestor also drops click names an SDK sends anyway.
Patterns scrubbed from page text and free text. None for legacy applications.
URL patterns where replay pauses and Analyze events drop.
Treat Global Privacy Control as an opt-out. Off for legacy applications.
Keep the email passed to setUser. On by default.
The customer’s own maximum retention for this application’s data, in
days. Absent, and by default, means no limit beyond the account’s
entitlement. See common::retention::ceiling: the entitlement is a MAX
over the account’s packs, which makes every window a floor, and this is
the only thing that lets a customer go below it.
object
Caps rum_measures (RUM Observe), the 458-day table.
Caps rum_events (RUM Analyze).
Replay retention ceiling, 7, 14 or 30 days, capped by the account entitlement.
Network, console, error and canvas capture (Wave 2). Omitted while default, like every
Wave 2 key: see rum_settings.
object
Network request capture. Method, status, timing and sizes are always recorded; headers only when allowlisted, bodies only for matching URLs.
object
Lower-case header names recorded on requests and responses.
URL prefixes (a path on the page’s origin, or an http(s) URL) whose JSON or text bodies are recorded.
URL prefixes, as body_urls, that receive a traceparent header.
Body capture limit, at most [MAX_NETWORK_BODY_BYTES].
Console levels recorded. Default: error and warn.
Error filters delivered to the SDK and applied again at ingest.
object
Message patterns whose errors are dropped.
Script URL patterns: errors whose top in-app frame matches are dropped.
Whether console.error calls also become issues.
Opt-in canvas recording (design 5.5, Phase 7).
object
Canvases recorded; empty means all.
Frames per second, 1 to 4.
WebP quality, 0.2 to 0.8.
Route rules applied at ingest before automatic id collapse.
A customer route rule: URLs matching pattern (/profiles/:id) get its route, named
name when given.
object
Issue lifecycle settings.
object
Open issues with no events for this many days are resolved. null turns it off.
Share of sessions that send Observe data, 0 to 1. Default 1.
Accept ingest requests without an Origin header (server-side senders).
Resource URLs not recorded as resource events: a path on the page’s origin (“/api/heartbeat”) or an absolute http(s) URL (“https://analytics.example.com”). At most 50.
CSS selectors whose clicks never count as rage or dead clicks, delivered to the SDK. Whitespace around each is trimmed and empty or repeated entries are dropped; then at most 50 remain, each up to 256 characters with no control characters, else the save is a 400.
Origins allowed to send data; empty allows all.
Monthly replay target that Auto sampling aims for, when set.
Revision of the published SDK config; increases on every settings or rule change.
Where the application’s data is stored (us).
Example
{ "settings": { "privacy": { "level": "strict", "pii_patterns": [ "email" ] }, "capture": { "network": { "body_urls": [], "header_allowlist": [ "content-type", "x-request-id" ], "max_body_bytes": 10240, "trace_urls": [] }, "console": [ "error", "warn" ], "errors": { "console_errors_as_issues": false, "deny_urls": [], "ignore": [] }, "canvas": { "enabled": false, "fps": 2, "quality": 0.4, "selectors": [] } }, "issues": { "auto_resolve_days": 14 } }}Invalid or unknown setting
Missing or invalid authentication
Privacy, retention, body_urls or header_allowlist changes need an account admin
Application not found
Internal server error
The SDK config could not be published; nothing was changed