---
title: "Rotate or re-scope a secret in place [write]"
method: PATCH
path: "/vaults/{id}/secrets/{secretId}"
tags: ["vaults"]
---

# Rotate or re-scope a secret in place \[write\]

`PATCH /vaults/{id}/secrets/{secretId}`

## Request

- Base URL: `https://api.agentsky.dev/v1`
- URL: `https://api.agentsky.dev/v1/vaults/{id}/secrets/{secretId}`
- Auth: HTTP bearer

The secret keeps its id and its placeholder, so attached pods need no restart — the recompiled policy is pushed to them. Fields not sent are left as they are; `injection_location` merges per field.

## Path parameters

- `id` string, required
- `secretId` string, required

## Request body

- UpdateVaultSecret
  - `display_name` string
  - `value` string
  - `token` string
  - `allowed_hosts` string[]: Omit to keep the current sites; send a list to replace them, or [] to stop credential injection.
  - `injection_location` object
    - `header` boolean
    - `body` boolean
    - `header_name` string
    - `value_template` string

## Response `200`

OK

- object
  - `secret` VaultSecret, required: Metadata only — the secret value is never returned after it is written. `secret_name` is set for environment_variable secrets, `mcp_server_url` for the two MCP kinds.
    - `type` 'vault_secret', required
    - `id` string, required: vsec_…
    - `display_name` string, required
    - `auth_type` 'static_bearer' | 'mcp_oauth' | 'environment_variable', required
    - `mcp_server_url` string
    - `secret_name` string: The environment variable the pod sees
    - `allowed_hosts` string[]: Environment-variable destination metadata. An empty list disables credential injection. Omit this field on update to keep the current sites; send [] to clear them.
    - `status` string, required
    - `expires_at` string, date-time
    - `created_at` string, date-time, required
    - `updated_at` string, date-time, required

## Other responses

- `default`: Error — { error: { code, message } }

## Changes

- **2026-11-02** `e5e8f0229a99`: 2 info
  - added the optional property `error/request_id` to the response with the `default` status
  - added the optional property `secret/allowed_hosts` to the response with the `200` status

[Operation history](https://skmtc.dev/agentsky/apis/agentsky-developer-api/changes/vaults/:id/secrets/:secretId/patch.md)

---

[API](https://skmtc.dev/agentsky/apis/agentsky-developer-api.md) - [All operations](https://skmtc.dev/agentsky/apis/agentsky-developer-api/llms.txt) - [OpenAPI document](https://skmtc.dev/agentsky/apis/agentsky-developer-api/revisions/0d435187cd55?raw)