---
title: "PATCH /api/v1/proxied-services/{serviceId}"
method: PATCH
path: "/api/v1/proxied-services/{serviceId}"
tags: ["Proxied Services"]
---

# PATCH /api/v1/proxied-services/{serviceId}

`PATCH /api/v1/proxied-services/{serviceId}`

Update a proxied service

## Path parameters

- `serviceId` string, uuid, required

## Request body

- object
  - `name` string — The new name of the proxied service.
  - `hostPattern` string — The new comma-separated host patterns.
  - `isEnabled` boolean — Whether the proxied service is enabled. The agent proxy skips disabled services.
  - `credentials` object[] — The new credentials. When provided, the entire credentials collection is replaced; when omitted, existing credentials are left unchanged.
    - `secretKey` string — The key name of the referenced static secret. The secret must live in the same folder as the service. Provide exactly one of secretKey or dynamicSecretName.
    - `dynamicSecretName` string — The name of the referenced dynamic secret. The dynamic secret must live in the same folder as the service; the agent proxy mints a lease and injects a field from its output. Provide exactly one of secretKey or dynamicSecretName. Referenced by name (like secretKey), so a deleted-then-recreated dynamic secret with the same name re-links automatically.
    - `dynamicSecretField` string — For a dynamic secret credential: which lease output field to inject (e.g. 'DB_PASSWORD', 'TOKEN'). Must be a valid output field for the dynamic secret's provider type.
    - `role` 'header-rewrite' | 'credential-substitution', required — How the credential is applied: 'header-rewrite' sets an HTTP header on the outbound request; 'credential-substitution' replaces a placeholder value in the request.
    - `headerName` string — For header rewriting: the header to set, e.g. 'Authorization' or 'x-api-key'.
    - `headerPrefix` string — For header rewriting: an optional prefix joined to the secret value with a space, e.g. 'Bearer'.
    - `headerPurpose` 'username' | 'password' — For HTTP basic auth: 'username' or 'password'. The agent proxy combines the pair into a single 'Authorization: Basic' header. Cannot be combined with headerName or headerPrefix.
    - `placeholderKey` string — For credential substitution: the environment variable name the agent receives.
    - `placeholderValue` string — For credential substitution: the placeholder value the agent proxy swaps for the real secret value on the wire.
    - `substitutionSurfaces` string[] — For credential substitution: which request surfaces are scanned for the placeholder. Allowed values: 'header', 'path', 'query', 'body'.

## Response `200`

Default Response

- object
  - `service` object, required
    - `id` string, uuid, required
    - `name` string, required
    - `hostPattern` string, required
    - `isEnabled` boolean
    - `folderId` string, uuid, required
    - `createdAt` string, date-time, required
    - `updatedAt` string, date-time, required
    - `lastUsedAt` string, date-time, nullable
    - `credentials` object[], required
      - `id` string, uuid, required
      - `serviceId` string, uuid, required
      - `secretKey` string, nullable
      - `role` string, required
      - `headerName` string, nullable
      - `headerPrefix` string, nullable
      - `headerPurpose` string, nullable
      - `placeholderKey` string, nullable
      - `placeholderValue` string, nullable
      - `substitutionSurfaces` string[], nullable
      - `dynamicSecretName` string, nullable
      - `dynamicSecretField` string, nullable

## Other responses

- `400` — Default Response
- `401` — Default Response
- `403` — Default Response
- `404` — Default Response
- `422` — Default Response
- `500` — Default Response

---

[API](https://skmtc.net/infisical/apis/infisical-api.md) · [All operations](https://skmtc.net/infisical/apis/infisical-api/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/infisical/infisical-api/versions/f10a4f8c1d41/schema)