---
title: "Update a document"
description: "Replaces a document's content, and optionally its title, password and expiry."
canonical_url: https://docs.markdrop.in/api/documents/update-a-document
last_updated: 2026-10-30
site: "Markdrop Docs"
index: https://docs.markdrop.in/llms.txt
---

# Update a document

`PUT https://api.markdrop.in/api/v1/documents/{slug}`

Replaces a document's content, and optionally its title, password and expiry. Send a token as the owner or an editor, or the document's edit secret in `X-Edit-Secret`.

- **Authentication:** Token optional: send `Authorization: Bearer mdk_…` to act as your account, or the document's edit secret in `X-Edit-Secret`.
- **Rate limit:** 10 per minute per IP address.
- **MCP tool:** `update_document` ([tools](https://docs.markdrop.in/ai/tools))
- **Guide:** [Edit key](https://docs.markdrop.in/documents/edit-key)

## Path parameters

- `slug` (string, required): The document's address: the part after `markdrop.in/`.

## Headers

- `X-Edit-Secret` (string): The document's edit secret (`sk_…`), for a document published without an account. See [Edit key](https://docs.markdrop.in/documents/edit-key).

## Request body

`application/json`, required.

- `title` (string): Shown on the page and in link previews. Up to 200 characters.
- `content` (string, required): The document's Markdown. 1–500,000 characters.
- `read_password` (string): Readers must enter this password before they see the content. Up to 100 characters.
- `remove_password` (boolean): `true` removes the password. Default `false`.
- `expires_in` ("never" | "1h" | "1d" | "7d" | "30d" | "custom"): When the document is deleted. `custom` needs `custom_expires_at`.
- `custom_expires_at` (string (date-time)): The deletion time, when `expires_in` is `custom`. Must be in the future. ISO 8601, for example `2026-11-30T12:00:00Z`.

## Responses

- `200`: OK.
  - `slug` (string): The address: `markdrop.in/<slug>`.
  - `url` (string): The link to share.
  - `folder_path` (array of string)
  - `title` (string | null): Shown on the page and in link previews.
  - `content` (string): The document's Markdown.
  - `created_at` (string (date-time)): ISO 8601, for example `2026-11-30T12:00:00Z`.
  - `updated_at` (string (date-time)): ISO 8601, for example `2026-11-30T12:00:00Z`.
  - `expires_at` (string (date-time) | null): ISO 8601, for example `2026-11-30T12:00:00Z`.
  - `views` (integer): Default `0`.
  - `is_password_protected` (boolean): Default `false`.
  - `is_owned` (boolean): Default `false`.
  - `is_owner` (boolean): Default `false`.
  - `id` (string | null)
  - `ref` (string | null)
  - `google_doc_url` (string | null)
  - `google_doc_stale` (boolean): Default `false`.
  - `vscode_synced` (boolean): Default `false`.
  - `encrypted` (boolean): Set by clients that encrypt in the browser: `content` and `title` are already ciphertext. The server never sees the key. Default `false`.
  - `kind` (string): `markdown` for a document, `artifact` for a file. Default `"markdown"`.
  - `mime` (string | null)
  - `renderer` (string | null)
  - `type_label` (string | null)
  - `size_bytes` (integer | null)
  - `original_filename` (string | null)
  - `artifact_url` (string | null)
  - `download_url` (string | null)
  - `poster_url` (string | null)
  - `media` (object | null)
  - `file_version` (integer | null)
  - `workspace_url` (string | null): The address on its workspace's own domain, when it has a live one.
  - `access_level` (string): Who can open it: `link` (anyone with the link), `private` (only you and the people you share it with) or `workspace` (members of its workspace). Default `"link"`.
  - `workspace_id` (string | null)
  - `can` (object | null): What you may do with it: `edit`, `replace`, `settings`, `access`, `rename`, `delete`, `share`, `move`, `unshare`.
  - `read_ticket` (string | null)
  - `access_epoch` (integer): Default `0`.
- `422`: The request didn't validate. `detail` lists each problem, with where it is (`loc`) and why (`msg`).
- `429`: Too many requests from your IP address. Wait the seconds in `Retry-After`.

## Examples

**curl**

```bash
curl -X PUT https://api.markdrop.in/api/v1/documents/k3x9q2m \
  -H "Authorization: Bearer $MARKDROP_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{
       "title": "Release notes",
       "content": "# Release notes\n\nUpdated from the API."
     }'
```

**JavaScript**

```javascript
const res = await fetch("https://api.markdrop.in/api/v1/documents/k3x9q2m", {
  method: "PUT",
  headers: {
    Authorization: `Bearer ${process.env.MARKDROP_TOKEN}`,
    "Content-Type": "application/json",
  },
  body: JSON.stringify({
    "title": "Release notes",
    "content": "# Release notes\n\nUpdated from the API."
  }),
});
const data = await res.json();
```

**Python**

```python
import os

import requests

r = requests.put(
    "https://api.markdrop.in/api/v1/documents/k3x9q2m",
    headers={"Authorization": f"Bearer {os.environ['MARKDROP_TOKEN']}"},
    json={
        "title": "Release notes",
        "content": "# Release notes\n\nUpdated from the API.",
    },
)
r.raise_for_status()
print(r.json())
```