---
title: "Update"
method: PATCH
path: "/api/v1/decoys/{id}"
tags: ["Decoy"]
---

# Update

`PATCH /api/v1/decoys/{id}`

Update modifies mutable metadata on a decoy. The decoy variant is
 fixed at Create -- rotate the secret with Rotate instead.

## Path parameters

- `id` string, required — The id field.

## Request body

- C1ApiDecoyV1DecoyServiceUpdateRequestInput — The DecoyServiceUpdateRequest message.
  - `decoy` C1ApiDecoyV1Decoy — Decoy is the public projection of a planted honey-credential. Read-only surface; the variant-specific back-references live in c1models and are not exposed here.
    - `annotations` object — Customer-defined grouping/filtering bag. PATCH semantics on Update: keys in the request overwrite, keys missing stay, keys set to empty string delete. Copied into the resulting Finding's custom_tags so routing rules can condition on the same keys.
    - `createdAt` string, date-time
    - `description` string — The description field.
    - `disabled` boolean — Admin-disabled.
    - `displayName` string — The displayName field.
    - `id` string — The id field.
    - `kind` 'DECOY_KIND_UNSPECIFIED' | 'DECOY_KIND_USER_CLIENT_CREDENTIAL' | 'DECOY_KIND_CONNECTOR_CLIENT' | 'DECOY_KIND_WORKLOAD_FEDERATION' | 'DECOY_KIND_ACCESS_TOKEN' — The kind field.
    - `updatedAt` string, date-time
  - `updateMask` string, nullable

## Response `200`

Successful response

- C1ApiDecoyV1DecoyServiceUpdateResponse — The DecoyServiceUpdateResponse message.
  - `decoy` C1ApiDecoyV1Decoy — Decoy is the public projection of a planted honey-credential. Read-only surface; the variant-specific back-references live in c1models and are not exposed here.
    - `annotations` object — Customer-defined grouping/filtering bag. PATCH semantics on Update: keys in the request overwrite, keys missing stay, keys set to empty string delete. Copied into the resulting Finding's custom_tags so routing rules can condition on the same keys.
    - `createdAt` string, date-time
    - `description` string — The description field.
    - `disabled` boolean — Admin-disabled.
    - `displayName` string — The displayName field.
    - `id` string — The id field.
    - `kind` 'DECOY_KIND_UNSPECIFIED' | 'DECOY_KIND_USER_CLIENT_CREDENTIAL' | 'DECOY_KIND_CONNECTOR_CLIENT' | 'DECOY_KIND_WORKLOAD_FEDERATION' | 'DECOY_KIND_ACCESS_TOKEN' — The kind field.
    - `updatedAt` string, date-time

---

[API](https://skmtc.net/conductorone/apis/c1-api.md) · [All operations](https://skmtc.net/conductorone/apis/c1-api/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/conductorone/c1-api/revisions/d391405a35d3/schema)