---
title: "Update or rotate credential"
method: PATCH
path: "/credentials/{credential_id}"
tags: ["Credentials"]
---

# Update or rotate credential

`PATCH /credentials/{credential_id}`

Update or rotate a credential.

## Path parameters

- `credential_id` string, required

## Request body

- union
  - BearerTokenUpdateRequest — Update request for bearer_token credentials.
    - `active` boolean, nullable
    - `name` string, nullable
    - `runtime_config` RuntimeConfig — Optional per-upstream-call overrides.
      - `headers` object, nullable
      - `query_params` object, nullable
    - `server_variables` object, nullable
    - `token` string, nullable
    - `type` 'bearer_token', required
  - ApiKeyUpdateRequest — Update request for api_key credentials.
    - `active` boolean, nullable
    - `field_name` string, nullable — Immutable after create. Accepted for backward compatibility; if provided it must equal the stored value, otherwise the request is rejected. Recreate the credential to change the parameter name.
    - `key` string, nullable
    - `location` 'header' | 'query' | 'cookie' — Where an API-key credential is injected into a request.
    - `name` string, nullable
    - `runtime_config` RuntimeConfig — Optional per-upstream-call overrides.
      - `headers` object, nullable
      - `query_params` object, nullable
    - `server_variables` object, nullable
    - `type` 'api_key', required
  - BasicAuthUpdateRequest — Update request for basic credentials.
    - `active` boolean, nullable
    - `name` string, nullable
    - `password` string, nullable
    - `runtime_config` RuntimeConfig — Optional per-upstream-call overrides.
      - `headers` object, nullable
      - `query_params` object, nullable
    - `server_variables` object, nullable
    - `type` 'basic', required
    - `username` string, nullable
  - OAuth2UpdateRequest — Update request for oauth2 credentials.
    - `active` boolean, nullable
    - `client_secret` string, nullable
    - `name` string, nullable
    - `runtime_config` RuntimeConfig — Optional per-upstream-call overrides.
      - `headers` object, nullable
      - `query_params` object, nullable
    - `scopes` string[], nullable
    - `server_variables` object, nullable
    - `token_url` string, nullable
    - `type` 'oauth2', required
  - Sigv4UpdateRequest — Update request for sigv4 credentials (key rotation / scope edit).
    - `access_key_id` string, nullable
    - `active` boolean, nullable
    - `aws_region` string, nullable
    - `aws_service` string, nullable
    - `clear_session_token` boolean
    - `name` string, nullable
    - `runtime_config` RuntimeConfig — Optional per-upstream-call overrides.
      - `headers` object, nullable
      - `query_params` object, nullable
    - `secret_access_key` string, nullable
    - `server_variables` object, nullable
    - `session_token` string, nullable
    - `type` 'sigv4', required

## Response `200`

Successful Response

- CredentialRedactedResponse — Redacted credential response (for read/list/patch).
  - `active` boolean, required — Whether the credential is enabled for injection.
  - `api` APIReference, required — Identifies a target API — the strict (all-required) variant. Used in responses and as the canonical identity tuple.
    - `name` string, required
    - `vendor` string, required
    - `version` string, required
  - `catalog_api_id` string, nullable — Catalog identity slug of the target API (`domain[/sub-api]`), when recorded at create time. Display-only; null for older credentials.
  - `created_at` string, date-time, required — Creation timestamp (UTC).
  - `created_by` string, nullable — Identity that created the credential (its owner).
  - `credential_id` string, required — Stable credential identifier, prefixed `cred_`.
  - `details` object, nullable — Redacted, type-specific projection (hints/last-N chars; never the secret). For oauth2: client_id, token_url, grant_type (authorization_code | client_credentials), scopes, and — for authorization_code only — `connected`, whether the interactive sign-in completed and is still usable (null for other grants).
  - `name` string, required — Human-readable label.
  - `provider` string, required — Credential provider; 'static' for stored secrets.
  - `provider_account_ref` string, nullable — Opaque reference to the provider account, when applicable.
  - `server_variables` object, nullable — OpenAPI server-variable values for URL template substitution.
  - `type` 'bearer_token' | 'api_key' | 'basic' | 'oauth2' | 'no_auth' | 'sigv4', required — Wire-level credential type used by the provider abstraction.
  - `updated_at` string, date-time, nullable — Last update timestamp (UTC).

## Other responses

- `400` — Bad Request
- `401` — Unauthorized
- `403` — Forbidden
- `404` — Not Found
- `422` — Unprocessable Entity
- `500` — Internal Server Error
- `503` — Service Unavailable

---

[API](https://skmtc.net/jentic/apis/jentic-control-plane-api.md) · [All operations](https://skmtc.net/jentic/apis/jentic-control-plane-api/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/jentic/jentic-control-plane-api/revisions/25c23e262a29/schema)