---
title: "Update a vault"
method: PATCH
path: "/api/vaults/{id}"
---

# Update a vault

`PATCH /api/vaults/{id}`

## Request

- Base URL: `https://api.hyperbrowser.ai`
- URL: `https://api.hyperbrowser.ai/api/vaults/{id}`
- Auth: API key in header `x-api-key`
- TypeScript: <https://skmtc.dev/hyperbrowser/apis/hyperbrowser-api/docs/api/vaults/:id/patch.ts> (a function with typed inputs; its response is checked against the schema)

Changes a vault's description or entries. Entries you pass replace those variables and `null` removes one; others are kept. Processes that already started keep the values they received. Secrets are enabled for teams on request; please contact support to enable them (otherwise 403 SECRETS_FEATURE_DISABLED). Restricted API keys need the secrets.manage scope. When you're signed in rather than using an API key, you must be a team owner or admin (otherwise 403 SECRETS_ADMIN_REQUIRED).

## Path parameters

- `id` string, uuid, required

## Request body

- UpdateVaultParams: Provide `description`, `entries`, or both.
  - `description` string: Replaces the description. Trimmed before it's stored.
  - `entries` object: Entries to change: each one given replaces that variable, `null` removes it, and variables not given are kept. Keys are environment variable names: letters, digits and `_`, not starting with a digit, at most 256 characters. A vault holds at most 32 entries (otherwise 409 VAULT_ENTRY_LIMIT_REACHED).

## Response `200`

Success

- Vault: A named set of environment variables. Holds no values.
  - `id` string, uuid, required
  - `name` string, required: 1-128 letters, digits, `_` or `-`, starting with a letter or digit. Unique within your team.
  - `description` string, required
  - `entries` object, required: Environment variable name to entry.
  - `createdAt` string, date-time, required
  - `updatedAt` string, date-time, required

## Other responses

- `400`: Invalid request body, or nothing to change.
- `401`: Authentication required.
- `403`: API_KEY_SCOPE_DENIED (the API key lacks a required scope), SECRETS_FEATURE_DISABLED, or SECRETS_ADMIN_REQUIRED.
- `404`: VAULT_NOT_FOUND, SECRET_NOT_FOUND, or SECRET_VERSION_NOT_FOUND.
- `409`: VAULT_ENTRY_LIMIT_REACHED or SECRET_TYPE_MISMATCH.
- `500`: Internal server error.

## Changes

- **2026-10-15** `225d94fe61a0`: 1 breaking, 6 warning, 3 info
  - removed `#/components/schemas/VaultOnePasswordEntry` from the `entries/additionalProperties/` request property `oneOf` list
  - removed the request property `source`
  - removed the optional property `entries/additionalProperties/field` from the response with the `200` status
  - removed the optional property `entries/additionalProperties/item` from the response with the `200` status
  - …6 more
- **2026-10-15** `6ca0b00ee564`: 1 info
  - endpoint added

[Operation history](https://skmtc.dev/hyperbrowser/apis/hyperbrowser-api/changes/api/vaults/:id/patch.md)

---

[API](https://skmtc.dev/hyperbrowser/apis/hyperbrowser-api.md) - [All operations](https://skmtc.dev/hyperbrowser/apis/hyperbrowser-api/llms.txt) - [OpenAPI document](https://skmtc.dev/hyperbrowser/apis/hyperbrowser-api/revisions/ef089024c533?raw)