Set an override

Fixes the flag on or off for one end user, {identityType}:{identityValue} in the path, optionally in one variant by its variantKey, whatever its targets and rollout say.

Replaces the end user's override, answering 201 when there was none. Works on an experiment's flag too, to put a tester in an arm.

Guide: Feature flags and A/B tests

Authorization

AuthorizationBearer <token>

A project secret key: vh_sk_... for production, vh_sk_test_... for test. Keep it on your servers.

In: header

Path parameters

projectId*string

The project's id, proj_.... A secret key works only in the project it belongs to.

featureFlagId*string

The flag's id, ff_....

identity*string

The end user, as {identityType}:{identityValue} with the value percent-encoded, such as email:alice@example.com.

Match^(?:person_id|distinct_id|email|external_id):[\s\S]*?$

Request body

application/json

TypeScript definitions

Use the request body type in TypeScript.

isEnabled*boolean

Whether the end user gets the flag on (true) or off (false).

variantKey?||

The key of the variant the end user always gets, only with isEnabled: true; for an experiment's flag, an arm's id. Omitted or null, the flag is on without a variant.

note?||

Why the override exists, such as who is testing what.

Examples

curl -X PUT "https://api.voidhash.com/api/v1/projects/proj_tz4a98xxat96iws9zmbrgj3a/feature-flags/ff_v8b3n5q0w2e7h7d2k9m4x1c6/overrides/email:ada@example.com" \  -H "Authorization: Bearer vh_sk_..." \  -H "Content-Type: application/json" \  -d '{    "isEnabled": true,    "note": "QA device for the new checkout"  }'

{  "id": "ff_ovr_n5q0w2e7h7d2k9m4x1c6v8b3",  "featureFlagId": "ff_v8b3n5q0w2e7h7d2k9m4x1c6",  "identityType": "email",  "identityValue": "ada@example.com",  "isEnabled": true,  "variantKey": null,  "note": "QA device for the new checkout",  "createdAt": "2026-03-09T08:31:12.000Z",  "updatedAt": "2026-03-09T08:31:12.000Z"}

{  "id": "ff_ovr_n5q0w2e7h7d2k9m4x1c6v8b3",  "featureFlagId": "ff_v8b3n5q0w2e7h7d2k9m4x1c6",  "identityType": "email",  "identityValue": "ada@example.com",  "isEnabled": true,  "variantKey": null,  "note": "QA device for the new checkout",  "createdAt": "2026-03-09T08:31:12.000Z",  "updatedAt": "2026-03-09T08:31:12.000Z"}

{  "error": {    "type": "invalid_request",    "code": "unknown_variant",    "message": "Feature flag ff_v8b3n5q0w2e7h7d2k9m4x1c6 has no variant with the key \"annual-first\".",    "param": "variantKey"  }}

{  "error": {    "type": "unauthenticated",    "code": "invalid_api_key",    "message": "This secret key is not valid."  }}

{  "error": {    "type": "permission_denied",    "code": "permission_denied",    "message": "Insufficient permissions."  }}

{  "error": {    "type": "not_found",    "code": "project_not_found",    "message": "There is no project proj_tz4a98xxat96iws9zmbrgj3a, or this credential cannot use it.",    "param": "projectId"  }}

{  "error": {    "type": "internal",    "code": "internal_error",    "message": "Something went wrong on our side. Try again, and contact support with the Request-Id header if it keeps failing."  }}

Response body

`application/json`

Errors

Status	`type`	`code`	When
400	`invalid_request`	`unknown_variant`	When the flag has no such variant.
400	`invalid_request`	`variant_requires_enabled`	For a variant with `isEnabled: false`.

It can also fail with the errors every operation shares, such as unauthenticated; see Errors.

More in Feature flags

Replaces the end user's override, answering 201 when there was none. Works on an experiment's flag too, to put a tester in an arm.

Guide: Feature flags and A/B tests

Authorization

AuthorizationBearer <token>

A project secret key: vh_sk_... for production, vh_sk_test_... for test. Keep it on your servers.

In: header

Path parameters

projectId*string

The project's id, proj_.... A secret key works only in the project it belongs to.

featureFlagId*string

The flag's id, ff_....

identity*string

The end user, as {identityType}:{identityValue} with the value percent-encoded, such as email:alice@example.com.

Match^(?:person_id|distinct_id|email|external_id):[\s\S]*?$

Request body

application/json

TypeScript definitions

Use the request body type in TypeScript.

isEnabled*boolean

Whether the end user gets the flag on (true) or off (false).

variantKey?||

The key of the variant the end user always gets, only with isEnabled: true; for an experiment's flag, an arm's id. Omitted or null, the flag is on without a variant.

note?||

Why the override exists, such as who is testing what.

Examples

curl -X PUT "https://api.voidhash.com/api/v1/projects/proj_tz4a98xxat96iws9zmbrgj3a/feature-flags/ff_v8b3n5q0w2e7h7d2k9m4x1c6/overrides/email:ada@example.com" \  -H "Authorization: Bearer vh_sk_..." \  -H "Content-Type: application/json" \  -d '{    "isEnabled": true,    "note": "QA device for the new checkout"  }'

{  "id": "ff_ovr_n5q0w2e7h7d2k9m4x1c6v8b3",  "featureFlagId": "ff_v8b3n5q0w2e7h7d2k9m4x1c6",  "identityType": "email",  "identityValue": "ada@example.com",  "isEnabled": true,  "variantKey": null,  "note": "QA device for the new checkout",  "createdAt": "2026-03-09T08:31:12.000Z",  "updatedAt": "2026-03-09T08:31:12.000Z"}

{  "id": "ff_ovr_n5q0w2e7h7d2k9m4x1c6v8b3",  "featureFlagId": "ff_v8b3n5q0w2e7h7d2k9m4x1c6",  "identityType": "email",  "identityValue": "ada@example.com",  "isEnabled": true,  "variantKey": null,  "note": "QA device for the new checkout",  "createdAt": "2026-03-09T08:31:12.000Z",  "updatedAt": "2026-03-09T08:31:12.000Z"}

{  "error": {    "type": "invalid_request",    "code": "unknown_variant",    "message": "Feature flag ff_v8b3n5q0w2e7h7d2k9m4x1c6 has no variant with the key \"annual-first\".",    "param": "variantKey"  }}

{  "error": {    "type": "unauthenticated",    "code": "invalid_api_key",    "message": "This secret key is not valid."  }}

{  "error": {    "type": "permission_denied",    "code": "permission_denied",    "message": "Insufficient permissions."  }}

{  "error": {    "type": "not_found",    "code": "project_not_found",    "message": "There is no project proj_tz4a98xxat96iws9zmbrgj3a, or this credential cannot use it.",    "param": "projectId"  }}

{  "error": {    "type": "internal",    "code": "internal_error",    "message": "Something went wrong on our side. Try again, and contact support with the Request-Id header if it keeps failing."  }}

Response body

`application/json`

Errors

Status	`type`	`code`	When
400	`invalid_request`	`unknown_variant`	When the flag has no such variant.
400	`invalid_request`	`variant_requires_enabled`	For a variant with `isEnabled: false`.

It can also fail with the errors every operation shares, such as unauthenticated; see Errors.

unknown_variant

variant_requires_enabled

200application/json

201application/json

400application/json

401application/json

403application/json

404application/json

500application/json

Set an override

unknown_variant

variant_requires_enabled

200application/json

201application/json

400application/json

401application/json

403application/json

404application/json

500application/json

`application/json`

`application/json`

`application/json`

`application/json`

`application/json`

`application/json`

`application/json`

`application/json`

`application/json`

`application/json`

`application/json`

`application/json`

`application/json`

`application/json`