--- title: "POST /update-item" method: POST path: "/update-item" tags: ["General"] --- # POST /update-item `POST /update-item` ## Request - Base URL: `https://api.akeyless.io` - URL: `https://api.akeyless.io/update-item` - Auth: none declared ## Request body - UpdateItem - `ProviderType` string - `accessibility` string: for personal password manager - `add-tag` string[]: List of the new tags that will be attached to this item - `ara-enabled` boolean, nullable: Enable or disable Agentic Runtime Authority rule enforcement for this item. When false, user-defined input/output rules are stored but not enforced; the base security validation still runs. AraEnabled is tri-state (nil/true/false), not a plain bool: it self-encodes its wire value (see akl.OptionalBool) so an explicit false survives the curl-proxy relay instead of being dropped like a default-false bool flag. - `cert-file-data` string: PEM Certificate in a Base64 format. Used for updating RSA keys' certificates. - `certificate-format` string - `change-event` string: Trigger an event when a secret value changed [true/false] (Relevant only for Static Secret) - `delete_protection` string: Protection from accidental deletion of this object [true/false] - `description` string: Description of the object - `enable-agentic-runtime-authority` boolean, nullable: EnableAra is the documented spelling of AraEnabled. Both set the same field; --ara-enabled shipped first and stays as an undocumented alias so existing scripts and the Terraform provider keep working. - `enable-ai-quorum` boolean, nullable: Turns on AI Quorum checks for this item. - `expiration-event-in` string[]: How many days before the expiration of the certificate would you like to be notified. - `gcp-sm-regions` string: GCP Secret Manager regions to query for regional secrets (comma-separated, e.g., us-east1,us-west1). Max 12 regions. USC with GCP targets only. - `host-provider` string: Host provider type [explicit/target], Default Host provider is explicit, Relevant only for SRA items. - `input-rule` string[]: Agentic input rule in name=...,rule=... format (e.g. name=rule1,rule=Sanitize input) - `item-custom-fields` object: Additional custom fields to associate with the item - `json` boolean: Set output format to JSON - `lock-during-sra-session` string: Lock this secret for read/update while an SRA session is active - `lock-on-read` string: Lock this secret after each successful value read - `lock-ttl` string: Lock TTL in minutes - `max-versions` string: Set the maximum number of versions, limited by the account settings defaults. - `name` string, required: Current item name - `new-metadata` string: Deprecated - use description - `new-name` string: New item name - `output-rule` string[]: Agentic output rule in name=...,rule=... format (e.g. name=rule1,rule=Mask secrets) - `rm-tag` string[]: List of the existent tags that will be removed from this item - `rotate-after-disconnect` string: StringOrBool accepts JSON strings, booleans, and numbers for backward compatibility with older SDK versions that send boolean values for rotate-after-disconnect. - `rotate-on-unlock` string: Rotate this secret after it is unlocked - `secure-access-add-host` string[]: List of the new hosts that will be attached to SRA servers host - `secure-access-allow-external-user` string: Allow providing external user for a domain users [true/false] - `secure-access-allow-port-forwading` boolean, nullable: Deprecated: old misspelled param, kept for backwards-compatibility. Hidden from help; use secure-access-allow-port-forwarding instead. - `secure-access-allow-port-forwarding` boolean, nullable: Enable Port forwarding while using CLI access (relevant only for EKS/GKE/K8s Dynamic-Secret) - `secure-access-api` string: Bastion's SSH control API endpoint. E.g. https://my.sra-server:9900 (relevant only for ssh cert issuer) - `secure-access-aws-account-id` string: The AWS account id (relevant only for aws) - `secure-access-aws-native-cli` boolean, nullable: The AWS native cli (relevant only for aws) - `secure-access-aws-region` string: The AWS region (relevant only for aws) - `secure-access-bastion-api` string: Deprecated. use secure-access-api - `secure-access-bastion-issuer` string: Deprecated. use secure-access-certificate-issuer - `secure-access-bastion-ssh` string: Deprecated. use secure-access-ssh - `secure-access-certificate-issuer` string: Path to the SSH Certificate Issuer for your Akeyless Secure Access - `secure-access-cluster-endpoint` string: The K8s cluster endpoint URL (relevant only for EKS/GKE/K8s Dynamic-Secret) - `secure-access-dashboard-url` string: The K8s dashboard url (relevant only for k8s) - `secure-access-db-name` string: The DB name (relevant only for DB Dynamic-Secret) - `secure-access-db-schema` string: The DB schema (relevant only for DB Dynamic-Secret) - `secure-access-enable` string: Enable/Disable secure remote access [true/false] - `secure-access-enforce-hosts-restriction` boolean, nullable: Enforce connections only to allowed SRA hosts - `secure-access-gateway` string - `secure-access-host` string[]: Target servers for connections (In case of Linked Target association, host(s) will inherit Linked Target hosts - Relevant only for Dynamic Secrets/producers) - `secure-access-rd-gateway-server` string: RD Gateway server (relevant only for rdp) - `secure-access-rdp-domain` string: Required when the Dynamic Secret is used for a domain user (relevant only for RDP Dynamic-Secret) - `secure-access-rdp-user` string: Override the RDP Domain username - `secure-access-rm-host` string[]: List of the existent hosts that will be removed from SRA servers host - `secure-access-ssh` string: Bastion's SSH server. E.g. my.sra-server:22 (relevant only for ssh cert issuer) - `secure-access-ssh-creds` string: Secret values contains SSH Credentials, either Private Key or Password [password/private-key] (relevant only for Static-Secret or Rotated-secret) - `secure-access-ssh-creds-user` string: SSH username to connect to target server, must be in 'Allowed Users' list (relevant only for ssh cert issuer) - `secure-access-url` string: Destination URL to inject secrets - `secure-access-use-internal-bastion` boolean, nullable: Deprecated. Use secure-access-use-internal-ssh-access - `secure-access-use-internal-ssh-access` boolean, nullable: Use internal SSH Access - `secure-access-web-browsing` boolean, nullable: Secure browser via Akeyless's Secure Remote Access (SRA) - `secure-access-web-proxy` boolean, nullable: Web-Proxy via Akeyless's Secure Remote Access (SRA) - `target` string[]: A list of targets to be associated with an SRA item, To specify multiple targets use argument multiple times - `token` string: Authentication token (see `/auth` and `/configure`) - `uid-token` string: The universal identity token, Required only for universal_identity authentication - `usc-tags` string: Comma-separated list of tags to apply to all secrets created/synced on the remote USC USC items only. - `use-tags-as-filter` string: Whether to filter the USC secret list using the specified usc-tags [true/false] USC items only. ## Response `200` updateItemResponse wraps response body. - UpdateItemOutput - `updated` boolean ## Other responses - `default`: errorResponse wraps any error to return it as a JSON object with one "error" field. --- [API](https://skmtc.dev/akeyless/apis/account-settings.md) - [All operations](https://skmtc.dev/akeyless/apis/account-settings/llms.txt) - [OpenAPI document](https://skmtc.dev/akeyless/apis/account-settings/revisions/6beb28d274ac?raw)