---
title: "Update connection"
method: PATCH
path: "/api/v1/connections/{id}"
tags: ["Connections"]
---

# Update connection

`PATCH /api/v1/connections/{id}`

Update connection settings, including the non-secret configuration fields returned by GET, plus base role, environment user attributes, and credentials. Round-trips with GET so a connection can be managed as code. `dialect` cannot be changed.

Credential fields (write-only, never returned):
- `passwordUnencrypted`: Update password (all dialects) or service account JSON (BigQuery)
- `privateKey`: Add/rotate RSA keypair for Snowflake keypair authentication
- `oauthClientSecretUnencrypted`: Update OAuth client secret (Snowflake, Databricks)

Changing `host` or `port` is subject to the same SSH tunnel and PrivateLink restrictions as connection create: you may only point a connection at an SSH tunnel already provisioned for your organization, and a PrivateLink host must belong to your organization. Requests that violate this return 400.

Note: Credentials are encrypted at rest and never returned in API responses.

## Path parameters

- `id` string, uuid, required — Connection ID

## Request body

- object — Request body for updating connection settings and credentials. At least one field must be provided. Secrets are write-only and never returned.
  - `acceptsLicense` boolean — Acceptance of the license terms (Oracle)
  - `allowsUserSpecificTimezones` boolean — Whether users may specify their own timezones
  - `alwaysScopeViewNames` boolean — Whether generated view names always include catalog/schema scoping
  - `authenticationType` string — Authentication type. Dialect-specific; known values are `aws-access-key`, `aws-cross-account-role`, `databricks-oauth-m2m`, `databricks-personal-access-token`, `databricks-oauth-user`, `mssql-sql-authentication`, `mssql-active-directory-password`, `mssql-active-directory-service-principal`, `snowflake-oauth-user`, `snowflake-external-oauth-user`, `snowflake-password`, `snowflake-keypair`, `bigquery-oauth-user`, `bigquery-byo-oauth-user`, `bigquery-service-account`, `bigquery-workload-identity-federation`.
  - `awsRoleArn` string — AWS IAM role ARN (Athena)
  - `baseRole` string — Default role to assign to this connection
  - `database` string — Database/catalog name (project ID for BigQuery)
  - `defaultSchema` string — Default schema for the connection
  - `enableDbSemanticLayerIntegration` boolean — Enable the dialect-native semantic layer integration (Snowflake, Databricks)
  - `enableDbSemanticLayerTopics` boolean — Enable dialect-native semantic layer topics (Snowflake, Databricks)
  - `environmentUserAttribute` object, nullable — User attribute settings for connection environments
    - `attributeName` string, required — Name of the user attribute for environment selection
    - `defaultValues` string[], nullable, required — Default values for the user attribute
  - `externalOauthAudience` string — External OAuth audience claim (Snowflake)
  - `externalOauthAuthorizationUrl` string, uri — External OAuth authorization URL, HTTPS (Snowflake)
  - `externalOauthTokenUrl` string, uri — External OAuth token URL, HTTPS (Snowflake)
  - `host` string — Hostname or IP of the database server (account identifier for Snowflake)
  - `hostOverride` string — Custom Snowflake host, overriding the account identifier
  - `includeOtherCatalogs` union — Additional catalogs/databases to include. Comma-separated string or array.
    - string
    - string[]
  - `includeSchemas` union — Schemas to include in schema refresh. Comma-separated string or array; empty means all schemas.
    - string
    - string[]
  - `inferRelationshipsFromColumnNames` boolean — Infer relationships from column-name conventions
  - `inferRelationshipsFromForeignKeys` boolean — Infer relationships from declared foreign keys
  - `maxBillingBytes` string — Maximum bytes billed for a query (BigQuery)
  - `name` string — Connection display name
  - `oauthClientId` string — OAuth client ID for admin schema refresh (Snowflake, Databricks)
  - `oauthClientSecretUnencrypted` string — OAuth client secret for admin schema refresh (Snowflake, Databricks). Write-only; never returned.
  - `offloadedSchemas` union — Schemas queried via the offloaded engine. Comma-separated string or array.
    - string
    - string[]
  - `passwordUnencrypted` string — New password or service account key. For BigQuery, this must be the JSON service account key file content.
  - `port` integer — Port number for the database connection
  - `privateKey` string — RSA private key for keypair authentication (Snowflake only). Must be PEM-encoded PKCS#8 format, minimum 2048-bit.
  - `queryTimeoutSeconds` integer — Query timeout in seconds (max 3600)
  - `queryTimezone` string — Timezone used for query results
  - `region` string — Region (BigQuery, Athena)
  - `scratchSchema` string — Schema used for data input (upload) tables
  - `systemTimezone` string — Timezone of the database
  - `trustServerCertificate` boolean — Whether to trust the server certificate
  - `useMachineAuth` boolean — Authenticate using machine (M2M OAuth) credentials
  - `username` string — Username to authenticate with (client email for BigQuery service accounts)
  - `warehouse` string — Warehouse (Snowflake) or HTTP path (Databricks)

## Response `200`

Connection updated successfully

- object — Update connection response
  - `message` string, required — Status message describing what was updated
  - `success` boolean, required — Whether the operation succeeded

## Other responses

- `400` — Invalid request body - at least one field must be provided
- `401` — Authentication required
- `403` — Permission denied - connection admin role required
- `404` — Connection not found

---

[API](https://skmtc.net/omniapp/apis/omni-api.md) · [All operations](https://skmtc.net/omniapp/apis/omni-api/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/omniapp/omni-api/versions/de7cac8b5983/schema)