diff --git a/tubearchivist/appsettings/src/config.py b/tubearchivist/appsettings/src/config.py
index b44d037a..9124242e 100644
--- a/tubearchivist/appsettings/src/config.py
+++ b/tubearchivist/appsettings/src/config.py
@@ -103,15 +103,19 @@ class AppConfig:
 
         return response["_source"]
 
-    def update_config(self, key, value):
+    def update_config(self, data: dict) -> AppConfigType:
         """update single config value"""
-        key_map = key.split(".")
-        self._validate_key(key_map)
-        self.config[key_map[0]][key_map[1]] = value
+        for key, value in data.items():
+            key_map = key.split(".")
+            self._validate_key(key_map)
+            self.config[key_map[0]][key_map[1]] = value
+
         response, status_code = ElasticWrap(self.ES_PATH).post(self.config)
         if not status_code == 200:
             print(response)
 
+        return self.config
+
     def _validate_key(self, key_map: list[str]) -> None:
         """raise valueerror on invalid key"""
         exists = self.CONFIG_DEFAULTS.get(key_map[0], {}).get(key_map[1])  # type: ignore  # noqa: E501
diff --git a/tubearchivist/appsettings/urls.py b/tubearchivist/appsettings/urls.py
index ff5edd0b..a93a2198 100644
--- a/tubearchivist/appsettings/urls.py
+++ b/tubearchivist/appsettings/urls.py
@@ -4,6 +4,11 @@ from appsettings import views
 from django.urls import path
 
 urlpatterns = [
+    path(
+        "config/",
+        views.AppConfigApiView.as_view(),
+        name="api-config",
+    ),
     path(
         "snapshot/",
         views.SnapshotApiListView.as_view(),
diff --git a/tubearchivist/appsettings/views.py b/tubearchivist/appsettings/views.py
index 77c7bbe9..f3bed62d 100644
--- a/tubearchivist/appsettings/views.py
+++ b/tubearchivist/appsettings/views.py
@@ -11,6 +11,36 @@ from task.src.task_manager import TaskCommand
 from task.tasks import run_restore_backup
 
 
+class AppConfigApiView(ApiBaseView):
+    """resolves to /api/appsettings/config/
+    GET: return app settings
+    POST: update app settings
+    """
+
+    permission_classes = [AdminOnly]
+
+    @staticmethod
+    def get(request):
+        """get config"""
+        response = AppConfig().config
+        return Response(response)
+
+    @staticmethod
+    def post(request):
+        """
+        update config values
+        data object where key is flatted CONFIG_DEFAULTS separated by '.', e.g.
+        {"subscriptions.channel_size": 5, "subscriptions.live_channel_size": 5}
+        """
+        data = request.data
+        try:
+            config = AppConfig().update_config(data)
+        except ValueError as err:
+            return Response({"error": str(err)}, status=400)
+
+        return Response(config)
+
+
 class SnapshotApiListView(ApiBaseView):
     """resolves to /api/appsettings/snapshot/
     GET: returns snapshot config plus list of existing snapshots