Partially updates one dashboard, report, commitment, alert, or budget subscription with an application/merge-patch+json body (RFC 7396). The writable fields are recipients.emails, recipients.slackChannels, and, on a scheduled subscription, subscriptions. Any other field, recipients: null, or null for either recipient list is 422 validation_failed. A patch that sets neither recipients nor subscriptions is 422 validation_failed. A wrong Content-Type is 415. Recipient and schedule value rules are on CustomerSubscriptionRecipients, CustomerSubscriptionRecipientPatch, and CustomerSubscriptionScheduleInput.
On a scheduled subscription, subscriptions is the desired set of dashboard, report, and commitment subscriptions. A type in the body and not on the document is added. A type on the document and missing from the body is removed. A type in both is updated when source.id or the schedule differs, and nextAt is recalculated. A stored entry this API does not list stays on the subscription. An empty subscriptions array is 422 validation_failed; deleting the item is DELETE. A repeated type is 422 customers.duplicate_subscription_type. An omitted subscriptions array leaves the nested types unchanged.
Create does not accept alert or budget. GET returns them. On an alert or a budget, subscriptions is accepted only when it is the one stored entry with the same type and source.id and no schedule. Any other array is 422 validation_failed. Those items never gain a dashboard, report, or commitment subscription. Alerts and budgets keep their own APIs for create, delete, and full management. This PATCH is the one write this API makes on them, and it may replace their recipient lists. DELETE of an alert or a budget returns 409 customers.entry_is_resource.
A patch whose normalized values match the stored values returns 200 and does not write. The etag is unchanged.
Recipient changes are allowed when the caller can edit every key on the document, including a key the response did not show. Otherwise they are allowed only when the caller removes exactly their own email: no added address, no Slack change, and no subscription-set change. Any other recipient change is 403. The caller must be allowed to manage every added or changed scheduled type and to delete every removed type.
If-Match must contain the current strong ETag. The token only covers fields this API can write. Idempotency-Key is required. The same key, caller, customer, method, path, body, and If-Match replays the stored success response. A different body or If-Match is 422 idempotency_key_reused. A missing key is 400 idempotency_key_required. While the first request is in progress, another request with that key is 409 idempotency_request_in_progress. A 4xx response releases the key. dryRun=true does not reserve the key. It returns the would-be subscription with the current etag and writes nothing.
Reads are immediately consistent. After a completed update, a GET of that id returns the new state.