# Update transaction

`PATCH https://api.nexus.gg/v1/attributions/transactions/{transactionId}`

Applies `action` and/or a replacement `playerId` to every attribution row that shares the given `transactionId` for your publisher account, using the same lookup as `getAttribution`.

Rows are checked and saved one at a time. If a row's linked payment transaction has already been paid out (it has a Trolley payment or batch id), processing stops at that row and the request returns 409 without applying that row's update. A `409` can come back after earlier rows in the same set have already been updated, so treat the set as partially applied and re-read it before retrying.

For `Chargeback`, `Fraud`, or `Refund`, a refund record is appended to the payment transaction; `Fraud` additionally flags that transaction as fraud. The request body only accepts `action` and `playerId`; any other property is rejected.

If nothing matches the `transactionId`, this returns 404.

**NOTE**: This method uses **secret** (`nexus_sk_...`) API keys and should never be called from or embedded into the gaming client. These routes should ONLY be accessed from your back-end services.

## Authorizations

- `X-SHARED-SECRET` (string, header, required) - Send your **secret** API key (`nexus_sk_...`) in the `X-SHARED-SECRET` header. [Generate one](/authentication/api-keys/) in the Publisher Dashboard.

## Path parameters

- `transactionId` (string, required) - Your own transactionId, exactly as sent when the transaction was created.

## Query parameters

- `groupId` (string) - Creator group.

## Request body (`application/x-www-form-urlencoded`)

- `action` (string) - New transaction status. Chargeback, Fraud, and Refund also append a refund record to the underlying payment transaction; Fraud additionally flags it as fraud. Allowed values: Refund, Fraud, Chargeback.
- `playerId` (string) - Overwrites the transaction's playerId directly. Not validated against any existing player record.

## Responses

### 200

Returns the transactions that were updated

#### Body (`application/json`)

### 400

bad input parameter