# Update a product

Updates an existing product in the Product Catalog. Use this API to update core product fields
such as name, description, category, effective dates, and custom fields.

Endpoint: PUT /commerce/products
Version: 2026-02-20
Security: bearerAuth

## Header parameters:

  - `Accept-Encoding` (string)
    Include the Accept-Encoding: gzip header to compress responses as a gzipped file. It can significantly reduce the bandwidth required for a response. 

If specified, Zuora automatically compresses responses that contain over 1000 bytes of data, and the response contains a Content-Encoding header with the compression algorithm so that your client can decompress it.

  - `Content-Encoding` (string)
    Include the Content-Encoding: gzip header to compress a request. With this header specified, you should upload a gzipped file for the request payload instead of sending the JSON payload.

  - `Zuora-Track-Id` (string)
    A custom identifier for tracing the API call. If you set a value for this header, Zuora returns the same value in the response headers. This header enables you to associate your system process identifiers with Zuora API calls, to assist with troubleshooting in the event of an issue.

The value of this field must use the US-ASCII character set and must not include any of the following characters: colon (:), semicolon (;), double quote ("), and quote (').

  - `Zuora-Entity-Ids` (string)
    An entity ID. If you have Zuora Multi-entity enabled and the OAuth token is valid for more than one entity, you must use this header to specify which entity to perform the operation in. If the OAuth token is only valid for a single entity, or you do not have Zuora Multi-entity enabled, you should not set this header.

  - `Zuora-Org-Ids` (string)
    Comma separated IDs. If you have Zuora Multi-Org enabled, 
you can use this header to specify which orgs to perform the operation in. If you do not have Zuora Multi-Org enabled, you should not set this header.

The IDs must be a sub-set of the user's accessible orgs. If you specify an org that the user does not have access to, the operation fails. This header is important in Multi-Org (MO) setups because it defines the organization context under which the API should operate—mainly used for read access or data visibility filtering. If the header is not set, the operation is performed in scope of the user's accessible orgs.

## Request fields (application/json):

  - `id` (string, required)
    Unique identifier of the product to update.
    Example: "8ad088009840d1c2019855e15c993f2f"

  - `name` (string)
    Product name.
    Example: "Software Service"

  - `description` (string)
    Product description.
    Example: "Software service - basic edition"

  - `category` (string)
    Product category label, for example, base, add-on.
    Example: "base"

  - `custom_fields` (object)
    Custom fields to set on the product. Keys must match configured custom field API names.
Values may be strings, numbers, booleans, or arrays depending on field definition.
    Example: {"HelloBay__c":"Updated value","Tags__c":["AI Powered","Internet Required"]}

  - `startDate` (string)
    Product effective start date (UTC, YYYY-MM-DD).
    Example: "2025-05-11"

  - `endDate` (string)
    Product effective end date (UTC, YYYY-MM-DD).
    Example: "2050-12-10"

## Response 200 fields (application/json):

  - `id` (string)
    Unique identifier of the product.
    Example: "00c86e3a0595442c88ed9ef8474b10a7"

  - `name` (string)
    Product name.
    Example: "Amadeus"

  - `description` (string)
    Product description.
    Example: "Software service - basic edition"

  - `category` (string)
    Product category label.
    Example: "base"

  - `productNumber` (string)
    Product number in the catalog.
    Example: "PC-00000095"

  - `sku` (string)
    Product SKU.
    Example: "SKU-00000122"

  - `startDate` (string)
    Product effective start date (UTC, YYYY-MM-DD).
    Example: "2024-01-08"

  - `endDate` (string)
    Product effective end date (UTC, YYYY-MM-DD).
    Example: "2050-12-31"

  - `state` (string)
    Current product state.
    Example: "product_active"

  - `allowFeatureChanges` (boolean)
    Whether features on this product can be changed.

  - `features` (array)
    Product features.

  - `legacyFeatures` (array)
    Legacy features associated with this product.

  - `contextFilters` (array)
    Context filters applied to the product.

  - `customFields` (object)
    Custom fields on the product.

  - `customObjects` (object,null)
    Custom objects linked to this product.

  - `netsuite` (object,null)
    Netsuite integration attributes.

  - `organizationLabels` (array)
    Organization labels for the product.

  - `productRatePlans` (array)
    Rate plans (PRPs) defined under the product.

  - `createdBy` (string)
    ID of the user who created the product.
    Example: "8a90a2fd8030ea2e018032b11d3a3f06"

  - `createdTime` (string)
    Timestamp when the product was created.
    Example: "2025-08-06T18:11:35.000-07:00"

  - `updatedBy` (string)
    ID of the user who last updated the product.
    Example: "53c162482f054f3ca08e1ec82dccfec9"

  - `updatedTime` (string)
    Timestamp when the product was last updated.
    Example: "2025-10-23T04:55:54.000-07:00"

## Response 400 fields (application/json):

  - `processId` (string)
    The ID of the process that handles the operation.

  - `reasons` (array)
    The container of the error code and message. This field is available only if the success field is false.

  - `reasons.code` (string)
    The error code of response.

  - `reasons.message` (string)
    The detail information of the error response

  - `requestId` (string)
    Unique identifier of the request.

  - `success` (boolean)
    Indicates whether the call succeeded.

## Response 401 fields (application/json):

  - `message` (string)
    Error message.

If the error message is "Authentication error", ensure that the Authorization request header contains valid authentication credentials, then retry the request. See [Authentication](https://developer.zuora.com/docs/guides/authentication/) for more information.

If the error message is "Failed to get user info", retry the request.

## Response 500 fields (application/json):

  - `reasons` (array)
    Example: [{"code":"ObjectNotFound","message":"Notification definition with id 6e569e1e05f040eda51a927b140c0ac1 does not exist"}]

  - `reasons.code` (string)
    The error code of response.

  - `reasons.message` (string)
    The detail information of the error response