REST API · credentials
PATCH /credentials/{id}
Updates a credential's name/auth. Body: {name, auth: {type, ...}}. A blank secret field preserves the existing ciphertext. `destinationHost` is immutable: send it unchanged or omit it — any other value is refused.
patch_api_credentials_update
Authentication
- Bearer
Parameters
| Name | In | Required | Schema | Description |
|---|---|---|---|---|
| id | path | yes | {"type":"string"} |
Request body
application/json · required
{
"name": "Support desk API key (rotated)",
"auth": {
"type": "bearer",
"token": "sk_live_def456"
}
}Responses
200
The updated credential (auth redacted).
application/json
{
"credential": {
"id": "9c6e6b3a-2f1e-4a3b-8c1d-7e2f5b6a9c10",
"name": "Support desk API key (rotated)",
"destinationHost": "api.support-vendor.example",
"auth": {
"type": "bearer",
"token": "***"
},
"createdAt": "2026-01-15T09:00:00+00:00",
"createdBy": "owner@example.com",
"updatedAt": "2026-01-15T09:05:00+00:00"
}
}404
Credential not found.
application/json
{
"required": [
"error"
],
"properties": {
"error": {
"description": "Machine-readable error code, e.g. \"not_found\", \"forbidden\", \"validation\".",
"type": "string",
"enum": [
"bad_request",
"unauthorized",
"insufficient_credits",
"forbidden",
"web_only",
"allowlist_widens",
"not_found",
"conflict",
"draft_revision_conflict",
"rollback_confirmation_conflict",
"not_replayable",
"targets_outside_allowlist",
"gone",
"deprecated_operation",
"validation",
"rate_limited",
"payment_provider",
"verification_unavailable",
"analytics_unavailable",
"credential_vault_unavailable",
"notification_grants_unavailable"
]
},
"message": {
"description": "Human-readable explanation of what went wrong. Absent on a field-level validation failure, where `fields` carries the detail instead.",
"type": "string"
},
"object": {
"description": "The resource the error concerns, when there is one.",
"required": [
"type",
"id"
],
"properties": {
"type": {
"type": "string"
},
"id": {
"type": "string"
}
},
"type": "object"
},
"action": {
"description": "What to do next, naming the call or the panel page that does it. Absent when there is no corrective step.",
"type": "string"
},
"fields": {
"description": "Present when `error` is \"validation\" — one message per rejected field, keyed by the field name.",
"type": "object",
"additionalProperties": {
"type": "string"
}
},
"retry_after": {
"description": "An RFC 3339 timestamp, the moment the request may be retried. Not every `rate_limited` refusal carries one.",
"type": "string",
"format": "date-time"
}
},
"type": "object"
}422
Validation failed.
application/json
{
"required": [
"error"
],
"properties": {
"error": {
"description": "Machine-readable error code, e.g. \"not_found\", \"forbidden\", \"validation\".",
"type": "string",
"enum": [
"bad_request",
"unauthorized",
"insufficient_credits",
"forbidden",
"web_only",
"allowlist_widens",
"not_found",
"conflict",
"draft_revision_conflict",
"rollback_confirmation_conflict",
"not_replayable",
"targets_outside_allowlist",
"gone",
"deprecated_operation",
"validation",
"rate_limited",
"payment_provider",
"verification_unavailable",
"analytics_unavailable",
"credential_vault_unavailable",
"notification_grants_unavailable"
]
},
"message": {
"description": "Human-readable explanation of what went wrong. Absent on a field-level validation failure, where `fields` carries the detail instead.",
"type": "string"
},
"object": {
"description": "The resource the error concerns, when there is one.",
"required": [
"type",
"id"
],
"properties": {
"type": {
"type": "string"
},
"id": {
"type": "string"
}
},
"type": "object"
},
"action": {
"description": "What to do next, naming the call or the panel page that does it. Absent when there is no corrective step.",
"type": "string"
},
"fields": {
"description": "Present when `error` is \"validation\" — one message per rejected field, keyed by the field name.",
"type": "object",
"additionalProperties": {
"type": "string"
}
},
"retry_after": {
"description": "An RFC 3339 timestamp, the moment the request may be retried. Not every `rate_limited` refusal carries one.",
"type": "string",
"format": "date-time"
}
},
"type": "object"
}503
The credential vault is not yet provisioned for this project.
application/json
{
"required": [
"error"
],
"properties": {
"error": {
"description": "Machine-readable error code, e.g. \"not_found\", \"forbidden\", \"validation\".",
"type": "string",
"enum": [
"bad_request",
"unauthorized",
"insufficient_credits",
"forbidden",
"web_only",
"allowlist_widens",
"not_found",
"conflict",
"draft_revision_conflict",
"rollback_confirmation_conflict",
"not_replayable",
"targets_outside_allowlist",
"gone",
"deprecated_operation",
"validation",
"rate_limited",
"payment_provider",
"verification_unavailable",
"analytics_unavailable",
"credential_vault_unavailable",
"notification_grants_unavailable"
]
},
"message": {
"description": "Human-readable explanation of what went wrong. Absent on a field-level validation failure, where `fields` carries the detail instead.",
"type": "string"
},
"object": {
"description": "The resource the error concerns, when there is one.",
"required": [
"type",
"id"
],
"properties": {
"type": {
"type": "string"
},
"id": {
"type": "string"
}
},
"type": "object"
},
"action": {
"description": "What to do next, naming the call or the panel page that does it. Absent when there is no corrective step.",
"type": "string"
},
"fields": {
"description": "Present when `error` is \"validation\" — one message per rejected field, keyed by the field name.",
"type": "object",
"additionalProperties": {
"type": "string"
}
},
"retry_after": {
"description": "An RFC 3339 timestamp, the moment the request may be retried. Not every `rate_limited` refusal carries one.",
"type": "string",
"format": "date-time"
}
},
"type": "object"
}