> For the complete documentation index, see [llms.txt](https://merithic.gitbook.io/merithic-docs/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://merithic.gitbook.io/merithic-docs/api-reference/endpoints/update.md).

# POST /update

Returns the latest version of your product as a complete instance tree, sealed under the buyer's key.

```
POST https://api.merithic.com/update
```

{% hint style="info" %}
Call [`/version`](/merithic-docs/api-reference/endpoints/version.md) first and only call this when it reports `update: true`. `/update` returns the entire build, so polling it wastes bandwidth and rate limit.
{% endhint %}

## Request

| Field        | Type             | Required | Description                                            |
| ------------ | ---------------- | -------- | ------------------------------------------------------ |
| `user_id`    | string or number | yes      | Roblox user ID.                                        |
| `product_id` | string           | yes      | Your product's ID.                                     |
| `key`        | string           | yes      | The buyer's license key.                               |
| `nonce`      | string           | yes      | Fresh random value, 16 to 128 alphanumeric characters. |
| `current`    | string           | no       | The version label you're holding.                      |

```json
{
  "user_id": "123456789",
  "product_id": "prod_abc123",
  "key": "the buyer's key",
  "nonce": "a1b2c3d4e5f60718",
  "current": "1.4.0"
}
```

## Response

```json
{
  "ok": true,
  "version": "1.4.2",
  "update": true,
  "cipher": "9f2a...",
  "tag": "4c81..."
}
```

The payload is sealed with the **same key + nonce scheme as** [**`/unlock`**](/merithic-docs/api-reference/endpoints/unlock.md). Verify `tag`, then XOR-decrypt `cipher` to get the instance tree. See [the scheme](/merithic-docs/api-reference/endpoints/unlock.md#the-scheme) for the exact steps and working decrypt code in three languages.

Decrypted, the payload describes the build:

```json
{
  "nonce": "a1b2c3d4e5f60718",
  "version": "1.4.2",
  "instances": [
    {
      "ClassName": "ModuleScript",
      "Name": "Main",
      "Properties": { "Source": "return function() end" },
      "Children": []
    }
  ]
}
```

## Applying the tree

{% tabs %}
{% tab title="Luau (server)" %}

```lua
-- Assumes `decrypt` is the tag-verify + XOR routine from /unlock.
local HttpService = game:GetService("HttpService")

local function buildInstance(node: any): Instance
	local inst = Instance.new(node.ClassName)
	for prop, value in pairs(node.Properties or {}) do
		-- Source only assignable from a plugin or with script injection rights
		pcall(function() (inst :: any)[prop] = value end)
	end
	for _, child in ipairs(node.Children or {}) do
		buildInstance(child).Parent = inst
	end
	return inst
end

local function applyUpdate(payload, target: Instance)
	for _, node in ipairs(payload.instances) do
		local built = buildInstance(node)
		local existing = target:FindFirstChild(built.Name)
		if existing then existing:Destroy() end
		built.Parent = target
	end
	print(("Updatr: applied %s"):format(payload.version))
end
```

{% endtab %}

{% tab title="Node.js" %}

```javascript
// `unlockDecrypt` is the tag-verify + XOR routine from /unlock.
import { unlockDecrypt } from "./updatr.js";

export async function fetchUpdate({ userId, productId, key, current }) {
  const nonce = crypto.randomBytes(16).toString("hex");

  const res = await fetch("https://api.merithic.com/update", {
    method: "POST",
    headers: { "Content-Type": "application/json" },
    body: JSON.stringify({
      user_id: String(userId),
      product_id: productId,
      key,
      nonce,
      current,
    }),
  });

  const body = await res.json();
  if (!body.ok || !body.update) return null;

  const payload = unlockDecrypt({ key, nonce, body });
  if (!payload || payload.nonce !== nonce) return null;

  return { version: body.version, instances: payload.instances };
}
```

{% endtab %}
{% endtabs %}

## A safe update loop

```
on server start
  ├── POST /version  { current: installed }
  ├── update == false?  ──> done, run normally
  └── update == true
        ├── POST /update  { nonce: fresh, current: installed }
        ├── verify tag  ──> mismatch? keep running the OLD build
        ├── decrypt + check nonce echo
        └── apply tree, record new version label
```

{% hint style="warning" %}
If verification fails, **keep running the version you already have**. Never wipe a working build because an update couldn't be verified, or a failed request becomes an outage for your buyers.
{% endhint %}

## See also

{% content-ref url="/pages/pSlqNdieolqd3BKJ7bcS" %}
[POST /version](/merithic-docs/api-reference/endpoints/version.md)
{% endcontent-ref %}

{% content-ref url="/pages/s4HsRum87vgVH4KC5lHW" %}
[POST /unlock](/merithic-docs/api-reference/endpoints/unlock.md)
{% endcontent-ref %}


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://merithic.gitbook.io/merithic-docs/api-reference/endpoints/update.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.