---
title: "PATCH /api/v1/agent-vault/proxies/{proxyId}"
method: PATCH
path: "/api/v1/agent-vault/proxies/{proxyId}"
tags: ["Agent Vault Proxies"]
---

# PATCH /api/v1/agent-vault/proxies/{proxyId}

`PATCH /api/v1/agent-vault/proxies/{proxyId}`

Update an Agent Vault proxy's name or settings

## Path parameters

- `proxyId` string, uuid, required

## Request body

- object
  - `name` string — The name of the proxy.
  - `trafficPolicy` 'any-host' | 'bundle-hosts' — Which hosts an agent may reach through this proxy. `any-host` lets every request out; `bundle-hosts` allows only hosts an access bundle covers, plus anything in `allowedHosts`, and refuses the rest with a 403.
  - `allowedHosts` string, nullable — Hosts that stay reachable under the `bundle-hosts` traffic policy even though no access bundle covers them. Still intercepted, and given no credential.
  - `pollInterval` integer — How often, in seconds, the proxy refreshes its sessions and settings. Between 10 and 300.

## Response `200`

Default Response

- object
  - `proxy` object, required
    - `id` string, uuid, required — The ID of the proxy.
    - `name` string, required — The name of the proxy.
    - `heartbeat` string, date-time, nullable, required — When the proxy last checked in, or `null` if it never has.
    - `isHealthy` boolean, required — Whether the proxy has checked in recently enough to be considered up.
    - `rootCaFingerprint` string, nullable, required — The SHA-256 fingerprint of the proxy's certificate authority. Pin this if you want to verify the proxy an agent connects to.
    - `rootCaExpiresAt` string, date-time, nullable, required — When the proxy's certificate authority expires.
    - `trafficPolicy` 'any-host' | 'bundle-hosts', required — Which hosts an agent may reach through this proxy. `any-host` lets every request out; `bundle-hosts` allows only hosts an access bundle covers, plus anything in `allowedHosts`, and refuses the rest with a 403.
    - `allowedHosts` string, nullable, required — Hosts that stay reachable under the `bundle-hosts` traffic policy even though no access bundle covers them. Still intercepted, and given no credential.
    - `pollInterval` number, required — How often, in seconds, the proxy refreshes its sessions and settings. Between 10 and 300.
    - `createdAt` string, date-time, required — When the proxy was registered.

## Other responses

- `400` — Default Response
- `401` — Default Response
- `403` — Default Response
- `404` — Default Response
- `422` — Default Response
- `500` — Default Response

## Changes

- **2026-09-22** `62b0ba9edfe9` — 1 info
  - endpoint added

[Change history](https://skmtc.dev/infisical/apis/infisical-api/changes/api/v1/agent-vault/proxies/:proxyId/patch.md)

---

[API](https://skmtc.dev/infisical/apis/infisical-api.md) · [All operations](https://skmtc.dev/infisical/apis/infisical-api/llms.txt) · [OpenAPI document](https://skmtc.dev/infisical/apis/infisical-api/revisions/b1861c910818?raw)