---
title: "PATCH /zones/{zone_id}/secrets/{id}"
method: PATCH
path: "/zones/{zone_id}/secrets/{id}"
tags: ["Secrets"]
---

# PATCH /zones/{zone_id}/secrets/{id}

`PATCH /zones/{zone_id}/secrets/{id}`

## Request

- Base URL: `https://docs.keycard.ai` (the document declares no server; this is the origin it was published from)
- URL: `https://docs.keycard.ai/zones/{zone_id}/secrets/{id}`
- Auth: one of:
  - HTTP bearer
  - OAuth 2
    - Client credentials
    - Token URL: `/service-account-token`

## Path parameters

- `zone_id` string, required: A globally unique opaque identifier
- `id` string, required

## Headers

- `X-Client-Request-ID` string, uuid

## Request body

- VaultApiUpdateSecretRequest
  - `name` string: A name for the entity to be displayed in UI
  - `description` string: A description of the entity
  - `metadata` VaultApiMetadata: A JSON object containing arbitrary metadata. Metadata will not be encrypted.
  - `data` union
    - VaultApiSecretTokenFields
      - `type` 'token', required
      - `token` string, required
    - VaultApiSecretPasswordFields
      - `type` 'password', required
      - `username` string, required
      - `password` string, required

## Response `200`

Secret updated successfully

- VaultApiSecret
  - `id` string, required: A globally unique opaque identifier
  - `entity_id` string, required: A globally unique opaque identifier
  - `zone_id` string, required: A globally unique opaque identifier
  - `version` integer, required
  - `type` 'token' | 'password', required
  - `name` string, required: A name for the entity to be displayed in UI
  - `description` string: A description of the entity
  - `metadata` VaultApiMetadata: A JSON object containing arbitrary metadata. Metadata will not be encrypted.
  - `created_at` string, date-time, required
  - `updated_at` string, date-time, required

## Other responses

- `400`: bad request error response when caller supplied invalid input data
- `401`: unauthorized error response when caller session is not authenticated
- `403`: forbidden error response when caller does not have permissions to a resource
- `429`: rate limit exceeded error response when caller has exhausted api limits for the given time period
- `500`: internal server error response when server encountered error of its own creation
- `503`: service unavailable error when server you're attempting to reach is not available
- `default`: internal server error response when server encountered error of its own creation

## Changes

- **2026-10-16** `0cfaff865771`: 14 breaking, 7 warning, 72 info
  - the response property `details/items/field` became optional for the status `400`
  - the response property `details/items/field` became optional for the status `401`
  - the response property `details/items/field` became optional for the status `403`
  - the response property `details/items/field` became optional for the status `429`
  - …89 more
- **2026-03-16** `d3d69f45bfed`: 3 info
  - the endpoint scheme security `OAuth2` was added to the API
  - the endpoint scheme security `bearerAuth` was added to the API
  - the endpoint scheme security `vault-api_bearerAuth` was removed from the API
- **2026-02-06** `edd1b760a989`: 1 breaking, 1 warning, 5 info
  - removed `#/components/schemas/vault_SecretTokenFields, #/components/schemas/vault_SecretPasswordFields` from the `data` request property `oneOf` list
  - deleted the `header` request parameter `X-Request-ID`
  - the endpoint scheme security `vault-api_bearerAuth` was added to the API
  - the endpoint scheme security `vault_bearerAuth` was removed from the API
  - …3 more

[Operation history](https://skmtc.dev/keycardai/apis/keycard-ai-keycard-api/changes/zones/:zone_id/secrets/:id/patch.md)

---

[API](https://skmtc.dev/keycardai/apis/keycard-ai-keycard-api.md) - [All operations](https://skmtc.dev/keycardai/apis/keycard-ai-keycard-api/llms.txt) - [OpenAPI document](https://skmtc.dev/keycardai/apis/keycard-ai-keycard-api/revisions/0dee67e0a73a?raw)