---
title: "Update connected account credentials"
method: POST
path: "/connected_accounts/{accountId}/credentials"
tags: ["Connected Accounts"]
---

# Update connected account credentials

`POST /connected_accounts/{accountId}/credentials`

## Request

- Base URL: `https://api.fireblocks.io/v1`
- URL: `https://api.fireblocks.io/v1/connected_accounts/{accountId}/credentials`
- Auth: none declared
- TypeScript: <https://skmtc.dev/fireblocks/apis/fireblocks-api/docs/connected_accounts/:accountId/credentials/post.ts> (a function with typed inputs; its response is checked against the schema)

Replace the API credentials (secret + API key) of a connected account.

Credentials belong to an API key, which can back a single account or an entire hierarchy.
Updating them affects all accounts sharing that key, so the endpoint returns an array of modified accounts.

The `creds` field must be a Base64-encoded RSA-encrypted credential blob; use
`GET /connected_accounts/credentials/public_key` to retrieve the public key for encryption.
Both `creds` and `apiKey` are mandatory.

Validation against the exchange is synchronous, but the update itself is **pending mobile
approval** — the existing credentials stay live until the change is approved, so none of the
affected accounts are disconnected in the meantime.

Endpoint Permission: Admin, Non-Signing Admin.

## Path parameters

- `accountId` string, required

## Headers

- `Idempotency-Key` string

## Request body

- UpdateConnectedAccountCredentialsRequest
  - `creds` string, byte, required: Base64-encoded RSA-encrypted credential blob (the new secret). Encrypt using the public key from GET /connected_accounts/credentials/public_key.
  - `apiKey` string, required: The new account-level API key. Mandatory for credential update.

## Response `201`

Credential update initiated (pending approval).

- UpdateConnectedAccountCredentialsResponse
  - `accounts` AddedConnectedAccountItem[], required: The account whose credentials are pending update (status WAITING_FOR_APPROVAL). Old credentials stay live until the change is approved.
    - `accountId` string, required: ID of the created account.
    - `name` string, required: Human-readable account name.
    - `parentAccountId` string: Parent account ID — present only for sub-accounts in an NLV2 hierarchy.
    - `status` 'WAITING_FOR_APPROVAL' | 'APPROVED' | 'REJECTED' | 'CANCELLED' | 'FAILED', required

## Other responses

- `400`: Bad request — credentials cannot be updated on a sub-account, or missing creds / apiKey.
- `403`: Insufficient permissions, or feature not enabled for this tenant.
- `404`: Connected account not found.
- `409`: Account is not in an updatable state, or the credentials belong to a different account.
- `422`: The provided credentials were rejected by the exchange.
- `default`: Error Response

---

[API](https://skmtc.dev/fireblocks/apis/fireblocks-api.md) - [All operations](https://skmtc.dev/fireblocks/apis/fireblocks-api/llms.txt) - [OpenAPI document](https://skmtc.dev/fireblocks/apis/fireblocks-api/revisions/4eba9965659a?raw)