---
title: "POST /identities/UpdateApiKeyCredentialProvider"
method: POST
path: "/identities/UpdateApiKeyCredentialProvider"
---

# POST /identities/UpdateApiKeyCredentialProvider

`POST /identities/UpdateApiKeyCredentialProvider`

Updates an existing API key credential provider.

## Request body

- object
  - `name` string, required — The name of the API key credential provider to update.
  - `apiKey` string, password — The new API key to use for authentication. This value replaces the existing API key and is encrypted and stored securely.
  - `apiKeySecretConfig` object — Contains a reference to a secret stored in Amazon Web Services Secrets Manager.
    - `secretId` string — The ID of the Amazon Web Services Secrets Manager secret that stores the secret value.
    - `jsonKey` string — The JSON key used to extract the secret value from the Amazon Web Services Secrets Manager secret.
  - `apiKeySecretSource` 'MANAGED' | 'EXTERNAL' — The source type of the API key secret. Use <code>MANAGED</code> if the secret is managed by the service, or <code>EXTERNAL</code> if you manage the secret yourself in Amazon Web Services Secrets Manager.

## Response `200`

Success

- UpdateApiKeyCredentialProviderResponse
  - `apiKeySecretArn` object, required — The Amazon Resource Name (ARN) of the API key secret in Amazon Web Services Secrets Manager.
    - `secretArn` string, required — The Amazon Resource Name (ARN) of the secret in Amazon Web Services Secrets Manager.
  - `apiKeySecretJsonKey` string — The JSON key used to extract the API key value from the Amazon Web Services Secrets Manager secret.
  - `apiKeySecretSource` 'MANAGED' | 'EXTERNAL' — The source type of the API key secret. Either <code>MANAGED</code> if the secret is managed by the service, or <code>EXTERNAL</code> if managed by the user in Amazon Web Services Secrets Manager.
  - `name` string, required — The name of the API key credential provider.
  - `credentialProviderArn` string, required — The Amazon Resource Name (ARN) of the API key credential provider.
  - `createdTime` string, date-time, required — The timestamp when the API key credential provider was created.
  - `lastUpdatedTime` string, date-time, required — The timestamp when the API key credential provider was last updated.

## Other responses

- `480` — ServiceQuotaExceededException
- `481` — UnauthorizedException
- `482` — ValidationException
- `483` — AccessDeniedException
- `484` — ConflictException
- `485` — DecryptionFailure
- `486` — ResourceNotFoundException
- `487` — ThrottlingException
- `488` — InternalServerException
- `489` — EncryptionFailure

---

[API](https://skmtc.net/aws/apis/bedrock-agentcore-control.md) · [All operations](https://skmtc.net/aws/apis/bedrock-agentcore-control/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/aws/bedrock-agentcore-control/revisions/0ebde766792b/schema)