---
title: "Update an upstream API credential — rotate a secret or fix its API binding"
method: PATCH
path: "/credentials/{cid}"
tags: ["credentials"]
---

# Update an upstream API credential — rotate a secret or fix its API binding

`PATCH /credentials/{cid}`

Update a credential's label, secret value, identity field, API binding, or auth_type.

Common use cases:
- Rotate an expired token or password (update `value`)
- Fix incorrect API binding (update `api_id`)
- Add username to existing credential (update `identity`)
- Relabel for clarity (update `label`)

Only changed fields need to be included in the request body. Omitted fields are left unchanged.

**Auth:** Requires human session OR agent key with explicit `PATCH /credentials` allow rule on jentic-mini credential.

## Path parameters

- `cid` string, required — Credential ID to update

## Request body

- CredentialPatch — Update an existing credential. Only provided fields are changed. Rotates secrets without rebinding.
  - `label` string, nullable — New credential label (optional)
  - `value` string, nullable — New credential value for rotation (optional, encrypted before storage)
  - `identity` string, nullable — New identity value (optional)
  - `api_id` string, nullable — New API ID to rebind this credential (optional)
  - `auth_type` 'bearer' | 'basic' | 'apiKey', nullable — Update the auth type for this credential. See `POST /credentials` for valid values and semantics.

## Response `200`

Successful Response

- CredentialOut — Upstream API credential metadata. Secret values are never returned after creation.
  - `id` string, required — Credential ID
  - `label` string, required — Human-readable label for this credential
  - `identity` string, nullable — Identity field (username, client ID, etc.) for basic auth or compound API key schemes
  - `api_id` string, nullable — API this credential is bound to
  - `auth_type` string, nullable — Auth type: bearer, basic, or apiKey
  - `created_at` number, nullable — Unix timestamp when created
  - `updated_at` number, nullable — Unix timestamp of last update
  - `account_id` string, nullable — OAuth broker account ID (if from OAuth broker)
  - `app_slug` string, nullable — OAuth app slug (if from OAuth broker)
  - `synced_at` number, nullable — Unix timestamp of last OAuth sync

## Other responses

- `422` — Validation Error

---

[API](https://skmtc.dev/jentic/apis/jentic-control-plane-api.md) · [All operations](https://skmtc.dev/jentic/apis/jentic-control-plane-api/llms.txt) · [OpenAPI document](https://skmtc-service-production.skmtc.workers.dev/v1/apis/jentic/jentic-control-plane-api/revisions/76e8f6063728/schema)