---
title: "Update Credential"
method: PUT
path: "/api/v1/credentials/{id}"
tags: ["Credentials"]
---

# Update Credential

`PUT /api/v1/credentials/{id}`

## Path parameters

- `id` string, uuid, required

## Request body

- Credential
  - `assigned_network_ids` string[], required — Networks this credential is assigned to (Broadcast scope). Hydrated from the `network_credentials` junction table.
  - `credential_type` union, required — Universal credential type — tagged enum stored as JSONB. Each variant represents a different credential protocol/method.
    - object — SNMPv1 community string — for legacy devices that only speak v1.
      - `community` union, required — Secret value that can be either inline content or a file path on the daemon host.
        - object
          - `mode` 'Inline', required
          - `value` string, required — The secret itself. Write-only — reads return a redacted placeholder.
        - object
          - `mode` 'FilePath', required
          - `path` string, required — Path to a file on the daemon host holding the secret.
      - `type` 'SnmpV1', required
    - object — SNMPv2c community string for querying network devices
      - `community` union, required — Secret value that can be either inline content or a file path on the daemon host.
        - object
          - `mode` 'Inline', required
          - `value` string, required — The secret itself. Write-only — reads return a redacted placeholder.
        - object
          - `mode` 'FilePath', required
          - `path` string, required — Path to a file on the daemon host holding the secret.
      - `type` 'SnmpV2c', required
    - object — SNMPv3 USM AuthPriv — security name + auth/priv protocols and passwords.
      - `auth_password` union, required — Secret value that can be either inline content or a file path on the daemon host.
        - object
          - `mode` 'Inline', required
          - `value` string, required — The secret itself. Write-only — reads return a redacted placeholder.
        - object
          - `mode` 'FilePath', required
          - `path` string, required — Path to a file on the daemon host holding the secret.
      - `auth_protocol` 'Sha1' | 'Sha256', required — SNMPv3 USM authentication protocol. Variants are limited to the modern, secure set Scanopy supports; MD5 / SHA-2 variants beyond these are intentionally excluded. Serialized form (e.g. "Sha256") is the wire value stored in the credential and used as the frontend select option value.
      - `context_name` string, nullable — Optional context name (default/empty context used if unset).
      - `priv_password` union, required — Secret value that can be either inline content or a file path on the daemon host.
        - object
          - `mode` 'Inline', required
          - `value` string, required — The secret itself. Write-only — reads return a redacted placeholder.
        - object
          - `mode` 'FilePath', required
          - `path` string, required — Path to a file on the daemon host holding the secret.
      - `priv_protocol` 'Aes128' | 'Aes256', required — SNMPv3 USM privacy (encryption) protocol.
      - `security_name` string, required — USM security (user) name.
      - `type` 'SnmpV3', required
    - object — Docker API proxy credentials. Target IP determined from host ip_addresses at scan time.
      - `path` string, nullable — Optional URL path prefix (e.g. "/v1.43")
      - `port` integer — Port for the Docker API proxy (default 2375)
      - `ssl_cert` union — Non-secret value that can be inline content or a file path on daemon host.
        - object
          - `mode` 'Inline', required
          - `value` string, required — The value itself.
        - object
          - `mode` 'FilePath', required
          - `path` string, required — Path to a file on the daemon host holding the value.
      - `ssl_chain` union — Non-secret value that can be inline content or a file path on daemon host.
        - object
          - `mode` 'Inline', required
          - `value` string, required — The value itself.
        - object
          - `mode` 'FilePath', required
          - `path` string, required — Path to a file on the daemon host holding the value.
      - `ssl_key` union — Secret value that can be either inline content or a file path on the daemon host.
        - object
          - `mode` 'Inline', required
          - `value` string, required — The secret itself. Write-only — reads return a redacted placeholder.
        - object
          - `mode` 'FilePath', required
          - `path` string, required — Path to a file on the daemon host holding the secret.
      - `type` 'DockerProxy', required
    - object — Local Docker socket access on the daemon host. `socket_path` optionally repoints the socket (non-default `DOCKER_HOST`); blank ⇒ the daemon auto-detects (bollard defaults).
      - `socket_path` string, nullable — Path to the Docker socket. Blank lets the daemon auto-detect it.
      - `type` 'DockerSocket', required
    - object — Podman API proxy credentials. Podman exposes a Docker-compatible REST API, so the fields mirror `DockerProxy`. Target IP determined from host ip_addresses at scan time.
      - `path` string, nullable — Optional URL path prefix (e.g. "/v1.43")
      - `port` integer — Port for the Podman API proxy (default 2375)
      - `ssl_cert` union — Non-secret value that can be inline content or a file path on daemon host.
        - object
          - `mode` 'Inline', required
          - `value` string, required — The value itself.
        - object
          - `mode` 'FilePath', required
          - `path` string, required — Path to a file on the daemon host holding the value.
      - `ssl_chain` union — Non-secret value that can be inline content or a file path on daemon host.
        - object
          - `mode` 'Inline', required
          - `value` string, required — The value itself.
        - object
          - `mode` 'FilePath', required
          - `path` string, required — Path to a file on the daemon host holding the value.
      - `ssl_key` union — Secret value that can be either inline content or a file path on the daemon host.
        - object
          - `mode` 'Inline', required
          - `value` string, required — The secret itself. Write-only — reads return a redacted placeholder.
        - object
          - `mode` 'FilePath', required
          - `path` string, required — Path to a file on the daemon host holding the secret.
      - `type` 'PodmanProxy', required
    - object — Local Podman socket access on the daemon host. `socket_path` optionally repoints the socket (e.g. rootful `/run/podman/podman.sock` vs rootless `$XDG_RUNTIME_DIR/podman/podman.sock`); blank ⇒ the daemon auto-detects via `resolve_podman_socket_path()`.
      - `socket_path` string, nullable — Path to the Podman socket. Blank lets the daemon auto-detect it.
      - `type` 'PodmanSocket', required
    - object — UniFi Network Application (controller) via an API key. **UniFi OS only** — a UniFi OS console (443) or UniFi OS Server (11443). The legacy self-hosted Network Application on 8443 does not support API keys; use [`CredentialType::UnifiLocalAdmin`] there.
      - `api_key` union, required — Secret value that can be either inline content or a file path on the daemon host.
        - object
          - `mode` 'Inline', required
          - `value` string, required — The secret itself. Write-only — reads return a redacted placeholder.
        - object
          - `mode` 'FilePath', required
          - `path` string, required — Path to a file on the daemon host holding the secret.
      - `port` integer — Controller HTTPS port. 443 for a UniFi OS console, 11443 for UniFi OS Server.
      - `site` string — Internal site name from the controller URL (`/manage/site/<name>`).
      - `type` 'UnifiApiKey', required
    - object — UniFi Network Application (controller) via a local-admin account. Works on every controller type, including the legacy self-hosted Network Application on 8443. Use a local-only admin account so MFA does not block the login.
      - `password` union, required — Secret value that can be either inline content or a file path on the daemon host.
        - object
          - `mode` 'Inline', required
          - `value` string, required — The secret itself. Write-only — reads return a redacted placeholder.
        - object
          - `mode` 'FilePath', required
          - `path` string, required — Path to a file on the daemon host holding the secret.
      - `port` integer — Controller HTTPS port. 443 UniFi OS console, 11443 UniFi OS Server, 8443 legacy.
      - `site` string — Internal site name from the controller URL (`/manage/site/<name>`).
      - `type` 'UnifiLocalAdmin', required
      - `username` string, required — Local admin account on the controller.
  - `host_assignments` CredentialHostAssignment[], required — Hosts this credential is assigned to (PerHost scope), with optional IP scoping. Hydrated from the `host_credentials` junction table.
    - `host_id` string, uuid, required — The host this entity belongs to.
    - `ip_address_ids` string[], nullable, required — IP address IDs to limit this credential to on the host. None = all host ip_addresses.
  - `name` string, required — Human-facing name for this credential.
  - `organization_id` string, uuid, required — The organization that owns this record.
  - `tags` string[], required — Tags assigned to this entity.
  - `created_at` string, date-time, required — When this record was first created.
  - `id` string, uuid, required — Server-assigned unique identifier.
  - `updated_at` string, date-time, required — When this record was last modified.

## Response `200`

Credential updated successfully

- ApiResponseCredential
  - `data` object — The result payload. Omitted on failure.
    - `assigned_network_ids` string[], required — Networks this credential is assigned to (Broadcast scope). Hydrated from the `network_credentials` junction table.
    - `credential_type` union, required — Universal credential type — tagged enum stored as JSONB. Each variant represents a different credential protocol/method.
      - object — SNMPv1 community string — for legacy devices that only speak v1.
        - `community` union, required — Secret value that can be either inline content or a file path on the daemon host.
          - object
            - `mode` 'Inline', required
            - `value` string, required — The secret itself. Write-only — reads return a redacted placeholder.
          - object
            - `mode` 'FilePath', required
            - `path` string, required — Path to a file on the daemon host holding the secret.
        - `type` 'SnmpV1', required
      - object — SNMPv2c community string for querying network devices
        - `community` union, required — Secret value that can be either inline content or a file path on the daemon host.
          - object
            - `mode` 'Inline', required
            - `value` string, required — The secret itself. Write-only — reads return a redacted placeholder.
          - object
            - `mode` 'FilePath', required
            - `path` string, required — Path to a file on the daemon host holding the secret.
        - `type` 'SnmpV2c', required
      - object — SNMPv3 USM AuthPriv — security name + auth/priv protocols and passwords.
        - `auth_password` union, required — Secret value that can be either inline content or a file path on the daemon host.
          - object
            - `mode` 'Inline', required
            - `value` string, required — The secret itself. Write-only — reads return a redacted placeholder.
          - object
            - `mode` 'FilePath', required
            - `path` string, required — Path to a file on the daemon host holding the secret.
        - `auth_protocol` 'Sha1' | 'Sha256', required — SNMPv3 USM authentication protocol. Variants are limited to the modern, secure set Scanopy supports; MD5 / SHA-2 variants beyond these are intentionally excluded. Serialized form (e.g. "Sha256") is the wire value stored in the credential and used as the frontend select option value.
        - `context_name` string, nullable — Optional context name (default/empty context used if unset).
        - `priv_password` union, required — Secret value that can be either inline content or a file path on the daemon host.
          - object
            - `mode` 'Inline', required
            - `value` string, required — The secret itself. Write-only — reads return a redacted placeholder.
          - object
            - `mode` 'FilePath', required
            - `path` string, required — Path to a file on the daemon host holding the secret.
        - `priv_protocol` 'Aes128' | 'Aes256', required — SNMPv3 USM privacy (encryption) protocol.
        - `security_name` string, required — USM security (user) name.
        - `type` 'SnmpV3', required
      - object — Docker API proxy credentials. Target IP determined from host ip_addresses at scan time.
        - `path` string, nullable — Optional URL path prefix (e.g. "/v1.43")
        - `port` integer — Port for the Docker API proxy (default 2375)
        - `ssl_cert` union — Non-secret value that can be inline content or a file path on daemon host.
          - object
            - `mode` 'Inline', required
            - `value` string, required — The value itself.
          - object
            - `mode` 'FilePath', required
            - `path` string, required — Path to a file on the daemon host holding the value.
        - `ssl_chain` union — Non-secret value that can be inline content or a file path on daemon host.
          - object
            - `mode` 'Inline', required
            - `value` string, required — The value itself.
          - object
            - `mode` 'FilePath', required
            - `path` string, required — Path to a file on the daemon host holding the value.
        - `ssl_key` union — Secret value that can be either inline content or a file path on the daemon host.
          - object
            - `mode` 'Inline', required
            - `value` string, required — The secret itself. Write-only — reads return a redacted placeholder.
          - object
            - `mode` 'FilePath', required
            - `path` string, required — Path to a file on the daemon host holding the secret.
        - `type` 'DockerProxy', required
      - object — Local Docker socket access on the daemon host. `socket_path` optionally repoints the socket (non-default `DOCKER_HOST`); blank ⇒ the daemon auto-detects (bollard defaults).
        - `socket_path` string, nullable — Path to the Docker socket. Blank lets the daemon auto-detect it.
        - `type` 'DockerSocket', required
      - object — Podman API proxy credentials. Podman exposes a Docker-compatible REST API, so the fields mirror `DockerProxy`. Target IP determined from host ip_addresses at scan time.
        - `path` string, nullable — Optional URL path prefix (e.g. "/v1.43")
        - `port` integer — Port for the Podman API proxy (default 2375)
        - `ssl_cert` union — Non-secret value that can be inline content or a file path on daemon host.
          - object
            - `mode` 'Inline', required
            - `value` string, required — The value itself.
          - object
            - `mode` 'FilePath', required
            - `path` string, required — Path to a file on the daemon host holding the value.
        - `ssl_chain` union — Non-secret value that can be inline content or a file path on daemon host.
          - object
            - `mode` 'Inline', required
            - `value` string, required — The value itself.
          - object
            - `mode` 'FilePath', required
            - `path` string, required — Path to a file on the daemon host holding the value.
        - `ssl_key` union — Secret value that can be either inline content or a file path on the daemon host.
          - object
            - `mode` 'Inline', required
            - `value` string, required — The secret itself. Write-only — reads return a redacted placeholder.
          - object
            - `mode` 'FilePath', required
            - `path` string, required — Path to a file on the daemon host holding the secret.
        - `type` 'PodmanProxy', required
      - object — Local Podman socket access on the daemon host. `socket_path` optionally repoints the socket (e.g. rootful `/run/podman/podman.sock` vs rootless `$XDG_RUNTIME_DIR/podman/podman.sock`); blank ⇒ the daemon auto-detects via `resolve_podman_socket_path()`.
        - `socket_path` string, nullable — Path to the Podman socket. Blank lets the daemon auto-detect it.
        - `type` 'PodmanSocket', required
      - object — UniFi Network Application (controller) via an API key. **UniFi OS only** — a UniFi OS console (443) or UniFi OS Server (11443). The legacy self-hosted Network Application on 8443 does not support API keys; use [`CredentialType::UnifiLocalAdmin`] there.
        - `api_key` union, required — Secret value that can be either inline content or a file path on the daemon host.
          - object
            - `mode` 'Inline', required
            - `value` string, required — The secret itself. Write-only — reads return a redacted placeholder.
          - object
            - `mode` 'FilePath', required
            - `path` string, required — Path to a file on the daemon host holding the secret.
        - `port` integer — Controller HTTPS port. 443 for a UniFi OS console, 11443 for UniFi OS Server.
        - `site` string — Internal site name from the controller URL (`/manage/site/<name>`).
        - `type` 'UnifiApiKey', required
      - object — UniFi Network Application (controller) via a local-admin account. Works on every controller type, including the legacy self-hosted Network Application on 8443. Use a local-only admin account so MFA does not block the login.
        - `password` union, required — Secret value that can be either inline content or a file path on the daemon host.
          - object
            - `mode` 'Inline', required
            - `value` string, required — The secret itself. Write-only — reads return a redacted placeholder.
          - object
            - `mode` 'FilePath', required
            - `path` string, required — Path to a file on the daemon host holding the secret.
        - `port` integer — Controller HTTPS port. 443 UniFi OS console, 11443 UniFi OS Server, 8443 legacy.
        - `site` string — Internal site name from the controller URL (`/manage/site/<name>`).
        - `type` 'UnifiLocalAdmin', required
        - `username` string, required — Local admin account on the controller.
    - `host_assignments` CredentialHostAssignment[], required — Hosts this credential is assigned to (PerHost scope), with optional IP scoping. Hydrated from the `host_credentials` junction table.
      - `host_id` string, uuid, required — The host this entity belongs to.
      - `ip_address_ids` string[], nullable, required — IP address IDs to limit this credential to on the host. None = all host ip_addresses.
    - `name` string, required — Human-facing name for this credential.
    - `organization_id` string, uuid, required — The organization that owns this record.
    - `tags` string[], required — Tags assigned to this entity.
    - `created_at` string, date-time, required — When this record was first created.
    - `id` string, uuid, required — Server-assigned unique identifier.
    - `updated_at` string, date-time, required — When this record was last modified.
  - `error` string, nullable — Human-readable failure message. Omitted on success.
  - `meta` ApiMeta, required — API metadata included in all responses
    - `api_version` integer, required — API version (integer, increments on breaking changes)
    - `server_version` string, required — Server version (semver)
  - `success` boolean, required — `true` when the request succeeded. `false` responses carry `error` instead of `data`.

## Other responses

- `400` — Validation error
- `404` — Credential not found

---

[API](https://skmtc.net/scanopy/apis/scanopy-api.md) · [All operations](https://skmtc.net/scanopy/apis/scanopy-api/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/scanopy/scanopy-api/versions/28e466341947/schema)