Credentials

Update or rotate credential

Changed on

Update or rotate a credential.

patch/credentials/{credential_id}

Request

  • Base URL: / (relative, and the document was published on a file host, not at the API’s origin)
  • URL: /credentials/{credential_id}
  • Auth: one of:
    • HTTP bearer
    • OAuth 2 (authorization code, authorization URL /authorize, token URL /oauth/token)

Path parameters

credential_idstring required

ID of the credential.

Example:cred_6968b39855d91a3561684b32

Request body

OR
OR
OR
OR

Example request

{
  "active": true,
  "name": "Stripe live key",
  "runtime_config": {
    "headers": {
      "Stripe-Version": "2024-04-10"
    },
    "query_params": {
      "locale": "en-GB"
    }
  },
  "server_variables": {
    "region": "eu"
  },
  "token": "example-secret",
  "type": "bearer_token"
}

Response

Successful Response

activeboolean required

Whether the credential is enabled for injection.

catalog_api_idstring nullable

Catalog identity slug of the target API (domain[/sub-api]), when recorded at create time. Display-only; null for older credentials.

created_atstring date-time required

Creation timestamp (UTC).

created_bystring nullable

Identity that created the credential (its owner).

credential_idstring required

Stable credential identifier, prefixed cred_.

detailsobject nullable

Redacted, type-specific projection (hints/last-N chars; never the secret). For oauth2: client_id, token_url, grant_type (authorization_code | client_credentials), scopes, and — for authorization_code only — connected, whether the interactive sign-in completed and is still usable (null for other grants).

namestring required

Human-readable label.

oauth_app_registration_idstring nullable

Id of the shared oauth_app_registrations row this credential was minted through, if any. Null for legacy embedded OAuth credentials and every non-OAuth type.

oauth_app_registration_namestring nullable

Admin-facing name of the shared OAuth app registration this credential was minted through. Null when the credential is not backed by a shared registration.

providerstring required

Credential provider; 'static' for stored secrets.

provider_account_refstring nullable

Opaque reference to the provider account, when applicable.

server_variablesobject nullable

OpenAPI server-variable values for URL template substitution.

type'bearer_token' | 'api_key' | 'basic' | 'oauth2' | 'no_auth' | 'sigv4' required

Wire-level credential type used by the provider abstraction.

updated_atstring date-time nullable

Last update timestamp (UTC).

Example response

{
  "active": true,
  "api": {
    "name": "stripe",
    "vendor": "stripe.com",
    "version": "2024-04-10"
  },
  "created_at": "2026-01-15T09:30:00Z",
  "credential_id": "cred_01HZX9...",
  "details": {
    "field_name": "Authorization",
    "hint": "…live_abcd",
    "location": "header"
  },
  "name": "Stripe live key",
  "provider": "static",
  "type": "api_key"
}

Changes

  • c516481e6ed8Revision changes
    • info

      the endpoint scheme security OAuth2 was added to the API

  • 1963116624b1Revision changes
    • info

      added the optional property to the response with the status

    • info

      added the optional property to the response with the status