---
title: "Update connection"
method: PATCH
path: "/connections/{id}"
tags: ["connections"]
---

# Update connection

`PATCH /connections/{id}`

## Request

- Base URL: `https://api.instruxi.dev/api/v1/enforcer`
- URL: `https://api.instruxi.dev/api/v1/enforcer/connections/{id}`
- Auth: one of:
  - API key in header `Authorization`
  - API key in header `X-API-Key`

Partial update (ResourceAuth write: tenant_admin/admin only). Scoped by the ROW's tenant, not the caller's: a platform admin (cross_tenant role) may update a connection in any tenant by id, a tenant_admin only in their own; there is no tenant_id field here and the row never moves tenant. A config field sent as the redacted marker value (i.e. round-tripping what Get returned) leaves that key's stored secret untouched rather than overwriting it with the literal marker — only fields with a REAL new value replace the sealed credential.

## Path parameters

- `id` string, required

## Request body

- EnforcerV3InternalUsecaseConnectionsUpdateInput
  - `config` object: non-nil replaces the whole config
  - `is_active` boolean
  - `name` string

## Response `200`

OK

- InternalDeliveryHttpHandlerConnectionResponse
  - `data` EnforcerV3InternalDomainConnectionTenantConnection
    - `config` object: Config is the decrypted credential map — populated only on authorized single-row reads, never on lists.
    - `created_at` string
    - `id` string
    - `is_active` boolean
    - `name` string
    - `provider` EnforcerV3InternalDomainConnectionProvider
      - `capability` EnforcerV3InternalDomainConnectionCapability
        - `created_at` string
        - `description` string
        - `id` string
        - `name` string
        - `updated_at` string
      - `capability_id` string
      - `created_at` string
      - `description` string
      - `id` string
      - `name` string
      - `updated_at` string
    - `provider_app_id` string: ProviderAppID is the provider's PUBLIC application id (e.g. the Privy app id). Plaintext (not in the sealed config) so it can be queried for login tenant resolution and served to the client SDK. app_secret stays in config_encrypted.
    - `provider_id` string
    - `send_enforcement` boolean: SendEnforcement marks this connection's tenant as wallet-send-enforced (multi-sig): the tenant's Privy smart wallets get the mandatory app-key owner quorum and rwa's signing gateway enforces send policy. It lives on the connection row — the mode is baggage of the cybrid-bank wiring for specific tenants, not a property of every Privy tenant. Plaintext (not in the sealed config) so operators flip it with one UPDATE. A tenant is enforced iff ANY active connection row carries the flag; when rotating the flagged connection, set it on the replacement row or enforcement drops.
    - `tenant_id` string
    - `updated_at` string
  - `success` boolean

## Other responses

- `400`: Bad Request
- `401`: Unauthorized
- `403`: Forbidden
- `409`: Conflict
- `500`: Internal Server Error

---

[API](https://skmtc.dev/instruxi/apis/enforcer-api.md) · [All operations](https://skmtc.dev/instruxi/apis/enforcer-api/llms.txt) · [OpenAPI document](https://skmtc.dev/instruxi/apis/enforcer-api/revisions/fa82bc1becc0?raw)