---
title: "PATCH /api/v1/projects/{projectId}/secret-validation-rules/{ruleId}"
method: PATCH
path: "/api/v1/projects/{projectId}/secret-validation-rules/{ruleId}"
tags: ["Secret Validation Rules"]
---

# PATCH /api/v1/projects/{projectId}/secret-validation-rules/{ruleId}

`PATCH /api/v1/projects/{projectId}/secret-validation-rules/{ruleId}`

Update Secret Validation Rule

## Path parameters

- `projectId` string, required
- `ruleId` string, uuid, required

## Request body

- object
  - `name` string — The name of the secret validation rule.
  - `description` string, nullable — An optional description of the secret validation rule.
  - `environmentSlug` string, nullable — The slug of the environment this rule is scoped to. Omit to leave the current scope unchanged; pass `null` to make the rule apply to every environment in the project.
  - `secretPath` string — The secret path this rule is scoped to.
  - `rule` union — The rule configuration: which secret type it targets and the constraints to enforce. Replaces the existing configuration as a whole, or omits to leave it untouched.
    - object
      - `type` 'static-secrets', required — The kind of secret the rule applies to. Determines which fields the rule accepts and where the constraints are enforced: `static-secrets` constraints run on write, while `dynamic-secrets` and `secret-rotations` constraints shape the generated credential.
      - `constraints` object[], required — The constraints enforced by this rule. Each constraint names what it checks (`type`), what it applies to (`appliesTo`), and its `value`, e.g. the minimum character count for `min-length` or the pattern for `regex-pattern`.
        - `type` 'min-length' | 'max-length' | 'regex-pattern' | 'required-prefix' | 'required-suffix' | 'prevent-value-reuse', required — The kind of check this constraint performs, e.g. `min-length`, `regex-pattern`, `required-prefix`, or `prevent-value-reuse`.
        - `appliesTo` 'key' | 'value', required — What the constraint checks: the secret key or the secret value.
        - `value` string, required — The value the constraint is checked against, e.g. the minimum length, the regex pattern, or the required prefix/suffix string.
    - object
      - `type` 'dynamic-secrets', required — The kind of secret the rule applies to. Determines which fields the rule accepts and where the constraints are enforced: `static-secrets` constraints run on write, while `dynamic-secrets` and `secret-rotations` constraints shape the generated credential.
      - `providers` string[], required — The dynamic secret providers this rule applies to. A lease is only constrained when its provider is listed here.
      - `constraints` object[], required — The constraints enforced by this rule. Each constraint names what it checks (`type`), what it applies to (`appliesTo`), and its `value`, e.g. the minimum character count for `min-length` or the pattern for `regex-pattern`.
        - `type` 'min-length' | 'max-length' | 'regex-pattern' | 'required-prefix' | 'required-suffix', required — The kind of check this constraint performs, e.g. `min-length`, `regex-pattern`, or `required-prefix`.
        - `appliesTo` 'password', required — What the constraint checks: the generated credential.
        - `value` string, required — The value the constraint is checked against, e.g. the minimum length, the regex pattern, or the required prefix/suffix string.
    - object
      - `type` 'secret-rotations', required — The kind of secret the rule applies to. Determines which fields the rule accepts and where the constraints are enforced: `static-secrets` constraints run on write, while `dynamic-secrets` and `secret-rotations` constraints shape the generated credential.
      - `providers` string[], required — The secret rotation providers this rule applies to. A rotation is only constrained when its provider is listed here.
      - `constraints` object[], required — The constraints enforced by this rule. Each constraint names what it checks (`type`), what it applies to (`appliesTo`), and its `value`, e.g. the minimum character count for `min-length` or the pattern for `regex-pattern`.
        - `type` 'min-length' | 'max-length' | 'regex-pattern' | 'required-prefix' | 'required-suffix', required — The kind of check this constraint performs, e.g. `min-length`, `regex-pattern`, or `required-prefix`.
        - `appliesTo` 'password', required — What the constraint checks: the generated credential.
        - `value` string, required — The value the constraint is checked against, e.g. the minimum length, the regex pattern, or the required prefix/suffix string.
  - `isActive` boolean — Whether the secret validation rule is active.

## Response `200`

Default Response

- object
  - `rule` union, required
    - object
      - `id` string, uuid, required
      - `name` string, required
      - `description` string, nullable
      - `projectId` string, required
      - `envId` string, uuid, nullable
      - `secretPath` string, required
      - `isActive` boolean
      - `createdAt` string, date-time, required
      - `updatedAt` string, date-time, required
      - `type` 'static-secrets', required — The kind of secret the rule applies to. Determines which fields the rule accepts and where the constraints are enforced: `static-secrets` constraints run on write, while `dynamic-secrets` and `secret-rotations` constraints shape the generated credential.
      - `constraints` object[], required — The constraints enforced by this rule. Each constraint names what it checks (`type`), what it applies to (`appliesTo`), and its `value`, e.g. the minimum character count for `min-length` or the pattern for `regex-pattern`.
        - `type` 'min-length' | 'max-length' | 'regex-pattern' | 'required-prefix' | 'required-suffix' | 'prevent-value-reuse', required — The kind of check this constraint performs, e.g. `min-length`, `regex-pattern`, `required-prefix`, or `prevent-value-reuse`.
        - `appliesTo` 'key' | 'value', required — What the constraint checks: the secret key or the secret value.
        - `value` string, required — The value the constraint is checked against, e.g. the minimum length, the regex pattern, or the required prefix/suffix string.
    - object
      - `id` string, uuid, required
      - `name` string, required
      - `description` string, nullable
      - `projectId` string, required
      - `envId` string, uuid, nullable
      - `secretPath` string, required
      - `isActive` boolean
      - `createdAt` string, date-time, required
      - `updatedAt` string, date-time, required
      - `type` 'dynamic-secrets', required — The kind of secret the rule applies to. Determines which fields the rule accepts and where the constraints are enforced: `static-secrets` constraints run on write, while `dynamic-secrets` and `secret-rotations` constraints shape the generated credential.
      - `providers` string[], required — The dynamic secret providers this rule applies to. A lease is only constrained when its provider is listed here.
      - `constraints` object[], required — The constraints enforced by this rule. Each constraint names what it checks (`type`), what it applies to (`appliesTo`), and its `value`, e.g. the minimum character count for `min-length` or the pattern for `regex-pattern`.
        - `type` 'min-length' | 'max-length' | 'regex-pattern' | 'required-prefix' | 'required-suffix', required — The kind of check this constraint performs, e.g. `min-length`, `regex-pattern`, or `required-prefix`.
        - `appliesTo` 'password', required — What the constraint checks: the generated credential.
        - `value` string, required — The value the constraint is checked against, e.g. the minimum length, the regex pattern, or the required prefix/suffix string.
    - object
      - `id` string, uuid, required
      - `name` string, required
      - `description` string, nullable
      - `projectId` string, required
      - `envId` string, uuid, nullable
      - `secretPath` string, required
      - `isActive` boolean
      - `createdAt` string, date-time, required
      - `updatedAt` string, date-time, required
      - `type` 'secret-rotations', required — The kind of secret the rule applies to. Determines which fields the rule accepts and where the constraints are enforced: `static-secrets` constraints run on write, while `dynamic-secrets` and `secret-rotations` constraints shape the generated credential.
      - `providers` string[], required — The secret rotation providers this rule applies to. A rotation is only constrained when its provider is listed here.
      - `constraints` object[], required — The constraints enforced by this rule. Each constraint names what it checks (`type`), what it applies to (`appliesTo`), and its `value`, e.g. the minimum character count for `min-length` or the pattern for `regex-pattern`.
        - `type` 'min-length' | 'max-length' | 'regex-pattern' | 'required-prefix' | 'required-suffix', required — The kind of check this constraint performs, e.g. `min-length`, `regex-pattern`, or `required-prefix`.
        - `appliesTo` 'password', required — What the constraint checks: the generated credential.
        - `value` string, required — The value the constraint is checked against, e.g. the minimum length, the regex pattern, or the required prefix/suffix string.

## Other responses

- `400` — Default Response
- `401` — Default Response
- `403` — Default Response
- `404` — Default Response
- `422` — Default Response
- `500` — Default Response

---

[API](https://skmtc.net/infisical/apis/infisical-api.md) · [All operations](https://skmtc.net/infisical/apis/infisical-api/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/infisical/infisical-api/revisions/e2a4b9a05251/schema)