---
title: "PATCH /api/v1/projects/{projectId}/secret-validation-rules/{ruleId}"
method: PATCH
path: "/api/v1/projects/{projectId}/secret-validation-rules/{ruleId}"
tags: ["Secret Validation Rules"]
---

# PATCH /api/v1/projects/{projectId}/secret-validation-rules/{ruleId}

`PATCH /api/v1/projects/{projectId}/secret-validation-rules/{ruleId}`

Update Secret Validation Rule

## Path parameters

- `projectId` string, required
- `ruleId` string, uuid, required

## Request body

- object
  - `name` string — The name of the secret validation rule.
  - `description` string, nullable — An optional description of the secret validation rule.
  - `environmentSlug` string, nullable — The slug of the environment this rule is scoped to. Omit to leave the current scope unchanged; pass `null` to make the rule apply to every environment in the project.
  - `secretPath` string — The secret path this rule is scoped to.
  - `rule` union — The rule configuration: which secret type it targets and the constraints to enforce. Replaces the existing configuration as a whole, or omits to leave it untouched.
    - object
      - `type` 'static-secrets', required — The kind of secret the rule applies to. Determines which fields the rule accepts and where the constraints are enforced: `static-secrets` constraints run on write, while `dynamic-secrets` and `secret-rotations` constraints shape the generated credential.
      - `constraints` object[], required — The constraints enforced by this rule. Each constraint names what it checks (`type`), what it applies to (`appliesTo`), and its `value`, e.g. the minimum character count for `min-length` or the pattern for `regex-pattern`.
        - `type` 'min-length' | 'max-length' | 'regex-pattern' | 'required-prefix' | 'required-suffix' | 'prevent-value-reuse', required — The kind of check this constraint performs, e.g. `min-length`, `regex-pattern`, `required-prefix`, or `prevent-value-reuse`.
        - `appliesTo` 'key' | 'value', required — What the constraint checks: the secret key or the secret value.
        - `value` string, required — The value the constraint is checked against, e.g. the minimum length, the regex pattern, or the required prefix/suffix string.
    - object
      - `type` 'dynamic-secrets', required — The kind of secret the rule applies to. Determines which fields the rule accepts and where the constraints are enforced: `static-secrets` constraints run on write, while `dynamic-secrets` and `secret-rotations` constraints shape the generated credential.
      - `providers` string[], required — The dynamic secret providers this rule applies to. A lease is only constrained when its provider is listed here.
      - `constraints` object[], required — The constraints enforced by this rule. Each constraint names what it checks (`type`), what it applies to (`appliesTo`), and its `value`, e.g. the minimum character count for `min-length` or the pattern for `regex-pattern`.
        - `type` 'min-length' | 'max-length' | 'regex-pattern' | 'required-prefix' | 'required-suffix', required — The kind of check this constraint performs, e.g. `min-length`, `regex-pattern`, or `required-prefix`.
        - `appliesTo` 'password', required — What the constraint checks: the generated credential.
        - `value` string, required — The value the constraint is checked against, e.g. the minimum length, the regex pattern, or the required prefix/suffix string.
    - object
      - `type` 'secret-rotations', required — The kind of secret the rule applies to. Determines which fields the rule accepts and where the constraints are enforced: `static-secrets` constraints run on write, while `dynamic-secrets` and `secret-rotations` constraints shape the generated credential.
      - `providers` string[], required — The secret rotation providers this rule applies to. A rotation is only constrained when its provider is listed here.
      - `constraints` object[], required — The constraints enforced by this rule. Each constraint names what it checks (`type`), what it applies to (`appliesTo`), and its `value`, e.g. the minimum character count for `min-length` or the pattern for `regex-pattern`.
        - `type` 'min-length' | 'max-length' | 'regex-pattern' | 'required-prefix' | 'required-suffix', required — The kind of check this constraint performs, e.g. `min-length`, `regex-pattern`, or `required-prefix`.
        - `appliesTo` 'password', required — What the constraint checks: the generated credential.
        - `value` string, required — The value the constraint is checked against, e.g. the minimum length, the regex pattern, or the required prefix/suffix string.
  - `isActive` boolean — Whether the secret validation rule is active.

## Response `200`

Default Response

- object
  - `rule` union, required
    - object
      - `id` string, uuid, required
      - `name` string, required
      - `description` string, nullable
      - `projectId` string, required
      - `envId` string, uuid, nullable
      - `secretPath` string, required
      - `isActive` boolean
      - `createdAt` string, date-time, required
      - `updatedAt` string, date-time, required
      - `type` 'static-secrets', required — The kind of secret the rule applies to. Determines which fields the rule accepts and where the constraints are enforced: `static-secrets` constraints run on write, while `dynamic-secrets` and `secret-rotations` constraints shape the generated credential.
      - `constraints` object[], required — The constraints enforced by this rule. Each constraint names what it checks (`type`), what it applies to (`appliesTo`), and its `value`, e.g. the minimum character count for `min-length` or the pattern for `regex-pattern`.
        - `type` 'min-length' | 'max-length' | 'regex-pattern' | 'required-prefix' | 'required-suffix' | 'prevent-value-reuse', required — The kind of check this constraint performs, e.g. `min-length`, `regex-pattern`, `required-prefix`, or `prevent-value-reuse`.
        - `appliesTo` 'key' | 'value', required — What the constraint checks: the secret key or the secret value.
        - `value` string, required — The value the constraint is checked against, e.g. the minimum length, the regex pattern, or the required prefix/suffix string.
    - object
      - `id` string, uuid, required
      - `name` string, required
      - `description` string, nullable
      - `projectId` string, required
      - `envId` string, uuid, nullable
      - `secretPath` string, required
      - `isActive` boolean
      - `createdAt` string, date-time, required
      - `updatedAt` string, date-time, required
      - `type` 'dynamic-secrets', required — The kind of secret the rule applies to. Determines which fields the rule accepts and where the constraints are enforced: `static-secrets` constraints run on write, while `dynamic-secrets` and `secret-rotations` constraints shape the generated credential.
      - `providers` string[], required — The dynamic secret providers this rule applies to. A lease is only constrained when its provider is listed here.
      - `constraints` object[], required — The constraints enforced by this rule. Each constraint names what it checks (`type`), what it applies to (`appliesTo`), and its `value`, e.g. the minimum character count for `min-length` or the pattern for `regex-pattern`.
        - `type` 'min-length' | 'max-length' | 'regex-pattern' | 'required-prefix' | 'required-suffix', required — The kind of check this constraint performs, e.g. `min-length`, `regex-pattern`, or `required-prefix`.
        - `appliesTo` 'password', required — What the constraint checks: the generated credential.
        - `value` string, required — The value the constraint is checked against, e.g. the minimum length, the regex pattern, or the required prefix/suffix string.
    - object
      - `id` string, uuid, required
      - `name` string, required
      - `description` string, nullable
      - `projectId` string, required
      - `envId` string, uuid, nullable
      - `secretPath` string, required
      - `isActive` boolean
      - `createdAt` string, date-time, required
      - `updatedAt` string, date-time, required
      - `type` 'secret-rotations', required — The kind of secret the rule applies to. Determines which fields the rule accepts and where the constraints are enforced: `static-secrets` constraints run on write, while `dynamic-secrets` and `secret-rotations` constraints shape the generated credential.
      - `providers` string[], required — The secret rotation providers this rule applies to. A rotation is only constrained when its provider is listed here.
      - `constraints` object[], required — The constraints enforced by this rule. Each constraint names what it checks (`type`), what it applies to (`appliesTo`), and its `value`, e.g. the minimum character count for `min-length` or the pattern for `regex-pattern`.
        - `type` 'min-length' | 'max-length' | 'regex-pattern' | 'required-prefix' | 'required-suffix', required — The kind of check this constraint performs, e.g. `min-length`, `regex-pattern`, or `required-prefix`.
        - `appliesTo` 'password', required — What the constraint checks: the generated credential.
        - `value` string, required — The value the constraint is checked against, e.g. the minimum length, the regex pattern, or the required prefix/suffix string.

## Other responses

- `400` — Default Response
- `401` — Default Response
- `403` — Default Response
- `404` — Default Response
- `422` — Default Response
- `500` — Default Response

## Changes

- **2026-08-27** `e15904efcbcd` — 5 warning, 5 info
  - added the new `ldap-password` enum value to the `rule/allOf[subschema #2]/anyOf[subschema #3]/providers/items/` response property for the response status `200`
  - added the new `mssql-credentials` enum value to the `rule/allOf[subschema #2]/anyOf[subschema #3]/providers/items/` response property for the response status `200`
  - added the new `mysql-credentials` enum value to the `rule/allOf[subschema #2]/anyOf[subschema #3]/providers/items/` response property for the response status `200`
  - added the new `oracledb-credentials` enum value to the `rule/allOf[subschema #2]/anyOf[subschema #3]/providers/items/` response property for the response status `200`
  - …6 more
- **2026-08-18** `e2a4b9a05251` — 2 warning, 5 info
  - removed the request property `inputs`
  - removed the request property `type`
  - api operation id `updateSecretValidationRule` was added
  - api tag `Secret Validation Rules` added
  - …3 more

[Change history](https://skmtc.dev/infisical/apis/infisical-api/changes/api/v1/projects/:projectId/secret-validation-rules/:ruleId/patch.md)

---

[API](https://skmtc.dev/infisical/apis/infisical-api.md) · [All operations](https://skmtc.dev/infisical/apis/infisical-api/llms.txt) · [OpenAPI document](https://skmtc-service-production.skmtc.workers.dev/v1/apis/infisical/infisical-api/revisions/c339fd54e42e/schema)