---
title: "Set a credential's provider, inject, and/or fill placement: which package credential needs it can satisfy, where a sc..."
method: PATCH
path: "/v1/credentials/{credential_id}"
tags: ["secrets"]
---

# Set a credential's provider, inject, and/or fill placement: which package credential needs it can satisfy, where a sc...

`PATCH /v1/credentials/{credential_id}`

## Request

- Base URL: `https://api.kody.codes`
- URL: `https://api.kody.codes/v1/credentials/{credential_id}`
- Auth: HTTP bearer

Set a credential's provider, inject, and/or fill placement: which package credential needs it can satisfy, where a scoped `credential(key)` client puts its value, and which request parts placeholders may fill (headers, query, path, body; null = anywhere). Works for user-scope secrets, OAuth connections, MCP servers (provider/inject only), and vault bindings (placement only) by credential id; needs Write on that credential and is audited. Never takes or returns a value.

Org permission: none (touches no org data).

## Path parameters

- `credential_id` string, required: Credential id from secretList, the integrations list, or packageGet credential options.

## Request body

- object
  - `provider` string, nullable: Provider slug (for example "github") package credential needs match against. Null clears it.
  - `inject` union: How a scoped credential client places a secret's value: a header with a "{value}" format, basic auth, or a query parameter. OAuth connections and MCP servers always use Authorization: Bearer.
    - object
      - `kind` 'header', required
      - `name` string, required
      - `format` string, required
    - object
      - `kind` 'basic', required
      - `valueAs` 'username' | 'password', required
      - `other` string
    - object
      - `kind` 'query', required
      - `param` string, required
  - `placement` object, nullable: Where placeholders for this credential may be filled: headers (optionally named), query, path, and/or body. Null means anywhere. Distinct from inject. Applies to secrets, OAuth integration tokens, and vault bindings. The gateway does not enforce this yet.
    - `headers` union
      - true
      - string[]
    - `query` true
    - `path` true
    - `body` true

## Response `200`

Success.

- object
  - `credential_id` string, required
  - `credential_kind` 'secret' | 'integration' | 'mcp-server' | 'vault', required
  - `name` string, required
  - `provider` string, nullable, required
  - `inject` union, required
    - object
      - `kind` 'header', required
      - `name` string, required
      - `format` string, required
    - object
      - `kind` 'basic', required
      - `valueAs` 'username' | 'password', required
      - `other` string
    - object
      - `kind` 'query', required
      - `param` string, required
  - `placement` object, nullable, required
    - `headers` union
      - true
      - string[]
    - `query` true
    - `path` true
    - `body` true

## Other responses

- `400`: Error envelope `{ "error": { "code", "message", "details"? } }`.
- `401`: Error envelope `{ "error": { "code", "message", "details"? } }`.
- `403`: Error envelope `{ "error": { "code", "message", "details"? } }`.
- `404`: Error envelope `{ "error": { "code", "message", "details"? } }`.
- `409`: Error envelope `{ "error": { "code", "message", "details"? } }`.
- `413`: Error envelope `{ "error": { "code", "message", "details"? } }`.
- `429`: Too many requests (edge IP/token limit) or an entitlement / plan-cap limit. Wait at least `Retry-After` seconds before retrying.
- `500`: Error envelope `{ "error": { "code", "message", "details"? } }`.
- `503`: Error envelope `{ "error": { "code", "message", "details"? } }`.
- `default`: Error envelope `{ "error": { "code", "message", "details"? } }`.

---

[API](https://skmtc.dev/kody/apis/kody-api.md) · [All operations](https://skmtc.dev/kody/apis/kody-api/llms.txt) · [OpenAPI document](https://skmtc.dev/kody/apis/kody-api/revisions/a020ecedb82b?raw)