---
title: "Update verification provider"
method: PUT
path: "/admin/verification-providers/{id}"
tags: ["verification-providers"]
---

# Update verification provider

`PUT /admin/verification-providers/{id}`

## Request

- Base URL: `https://api.instruxi.dev/api/v1/enforcer`
- URL: `https://api.instruxi.dev/api/v1/enforcer/admin/verification-providers/{id}`
- Auth: one of:
  - API key in header `Authorization`
  - API key in header `X-API-Key`

Patches a verification provider's config: omitted fields are unchanged, a supplied zero value clears the field. name and tenant are immutable. The WHOLE resulting config is re-validated with the create rules, so an update that leaves a dangling group reference or an unmapped allowed action is refused. Supplying auth_key seals it (and removes a legacy plaintext metadata.auth_key); "" clears it. Platform-admin only. Unknown body keys are 400.

## Path parameters

- `id` string, required

## Request body

- InternalDeliveryHttpHandlerUpdateVerificationProviderRequest
  - `action_group_map` object: action -> group SLUG. Every key must be in allowed_actions; every value a live group in the tenant.
  - `allowed_actions` string[]: Actions this provider may serve. Every entry must route to a group (its action_group_map entry or target_group_name). Empty permits every action.
  - `api_endpoint` string: gRPC SessionProvider address, e.g. enforcer-cybrid:50054. Required on create.
  - `auth_key` string: WRITE-ONLY shared secret sent to the SessionProvider (x-verifier-key). Sealed at rest; never returned. "" clears it.
  - `idempotency_enabled` boolean: Reuse a pending session instead of minting a new one.
  - `insecure` boolean: Dial plaintext gRPC (cluster-internal); TLS otherwise.
  - `is_async` boolean: Provider completes out-of-band via the verification.callback event.
  - `sensitive_fields` string[]: Response fields returned to the client but never persisted.
  - `session_ttl` integer: Session lifetime in seconds.
  - `target_group_name` string: Default group SLUG granted on a pass. Must be a live group in the tenant.

## Response `200`

OK

- InternalDeliveryHttpHandlerVerificationProviderResponse
  - `data` EnforcerV3InternalUsecaseVerificationprovidersView
    - `action_group_map` object
    - `allowed_actions` string[]
    - `api_endpoint` string
    - `auth_key_set` boolean: AuthKeySet reports whether the row has an auth key at all.
    - `auth_key_storage` 'encrypted' | 'plaintext' | 'none': AuthKeyStorage is "encrypted" (sealed column), "plaintext" (a legacy hand-inserted row's metadata.auth_key — re-set it through PUT to seal it) or "none".
    - `created_at` string
    - `id` string
    - `idempotency_enabled` boolean
    - `insecure` boolean
    - `is_async` boolean
    - `name` string
    - `sensitive_fields` string[]
    - `session_ttl` integer
    - `target_group_name` string
    - `tenant_id` string
    - `updated_at` string
  - `success` boolean

## Other responses

- `400`: Bad Request
- `401`: Unauthorized
- `403`: Forbidden
- `404`: Not Found
- `500`: Internal Server Error
- `503`: Service Unavailable

---

[API](https://skmtc.dev/instruxi/apis/enforcer-api.md) · [All operations](https://skmtc.dev/instruxi/apis/enforcer-api/llms.txt) · [OpenAPI document](https://skmtc.dev/instruxi/apis/enforcer-api/revisions/fa82bc1becc0?raw)