---
title: "Update environment variables"
method: PATCH
path: "/api/v1/cvms/{cvm_id}/envs"
tags: ["CVMs"]
---

# Update environment variables

`PATCH /api/v1/cvms/{cvm_id}/envs`

Updates encrypted environment variables. If env_keys changes for contract-owned KMS, requires two-phase flow with on-chain hash registration.

## Path parameters

- `cvm_id` string, required

## Request body

- BodyUpdateCvmEnvsApiV1CvmsCvmIdEnvsPatch
  - `encrypted_env` string, required — Encrypted env blob as hex string
  - `env_keys` string[], nullable — Allowed env var names. Changes trigger verification for contract-owned KMS.
  - `compose_hash` string, nullable — Hash from Phase 1 response (Phase 2 only)
  - `transaction_hash` string, nullable — Transaction hash proving on-chain registration (Phase 2 only)

## Response `202`

Update initiated, returns correlation_id and allowed_envs_changed flag

- unknown

## Other responses

- `401` — Authentication required
- `403` — CVM not in workspace
- `404` — CVM not found
- `409` — Another operation in progress
- `422` — Validation Error
- `465` — Compose hash registration required (env_keys changed, Phase 1)
- `466` — Compose hash invalid or expired
- `467` — Transaction verification failed
- `468` — Compose hash not allowed on-chain
- `500` — KMS configuration or RPC error

---

[API](https://skmtc.net/phala/apis/phala-cloud-api.md) · [All operations](https://skmtc.net/phala/apis/phala-cloud-api/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/phala/phala-cloud-api/versions/83c6ae62e860/schema)