---
title: "Update App Auth Strategy"
method: PATCH
path: "/v2/application-auth-strategies/{authStrategyId}"
tags: ["App Auth Strategies"]
---

# Update App Auth Strategy

`PATCH /v2/application-auth-strategies/{authStrategyId}`

Updates an application auth strategy.

## Request body

- UpdateAppAuthStrategyRequest — Request body for updating an Application Auth Strategy
  - `name` string — The name of the auth strategy. This is used to identify the auth strategy in the Konnect UI.
  - `display_name` string — The display name of the Auth strategy. This is used to identify the Auth strategy in the Portal UI.
  - `labels` LabelsUpdate, nullable — Labels store metadata of an entity that can be used for filtering an entity list or for searching across entity types. Labels are intended to store **INTERNAL** metadata. Keys must be of length 1-63 characters, and cannot start with "kong", "konnect", "mesh", "kic", or "_".
  - `dcr_provider_id` string, uuid, nullable
  - `configs` union — JSON-B object containing the configuration for the OIDC strategy under the key 'openid-connect' or the configuration for the Key Auth strategy under the key 'key-auth'
    - object
      - `openid-connect` PartialAppAuthStrategyConfigOpenIDConnect, required — A more advanced mode to configure an API Product Version’s Application Auth Strategy. Using this mode will allow developers to use API credentials issued from an external IdP that will authenticate their application requests. Once authenticated, an application will be granted access to any Product Version it is registered for that is configured for the same Auth Strategy. An OIDC strategy may be used in conjunction with a DCR provider to automatically create the IdP application.
        - `issuer` string, url, nullable
        - `credential_claim` string[], nullable
        - `scopes` string[], nullable
        - `auth_methods` string[], nullable
    - object
      - `key-auth` AppAuthStrategyConfigKeyAuth, required — The most basic mode to configure an Application Auth Strategy for an API Product Version. Using this mode will allow developers to generate API keys that will authenticate their application requests. Once authenticated, an application will be granted access to any Product Version it is registered for that is configured for Key Auth.
        - `key_names` string[], nullable — The names of the headers containing the API key. You can specify multiple header names.

## Response `200`

A response containing a single updated application auth strategy object.

- union — A set of plugin configurations that represent how the gateway will perform authentication and authorization for a Product Version. Called “Auth Strategy” for short in the context of portals/applications. The plugins are synced to any Gateway Service that is currently linked or becomes linked to the Product Version.
  - object — Response payload from creating or updating a Key Auth Application Auth Strategy
    - `id` string, uuid, required — Contains a unique identifier used for this resource.
    - `name` string, required — The name of the auth strategy. This is used to identify the auth strategy in the Konnect UI.
    - `display_name` string, required — The display name of the Auth strategy. This is used to identify the Auth strategy in the Portal UI.
    - `strategy_type` 'key_auth', required
    - `configs` object, required — JSON-B object containing the configuration for the Key Auth strategy
      - `key-auth` AppAuthStrategyConfigKeyAuth, required — The most basic mode to configure an Application Auth Strategy for an API Product Version. Using this mode will allow developers to generate API keys that will authenticate their application requests. Once authenticated, an application will be granted access to any Product Version it is registered for that is configured for Key Auth.
        - `key_names` string[], nullable — The names of the headers containing the API key. You can specify multiple header names.
    - `active` boolean, required — At least one published entity is using this auth strategy.
    - `dcr_provider` object, nullable, required
      - `id` string, uuid, required — Contains a unique identifier used for this resource.
      - `name` string, required
      - `display_name` string — The display name of the DCR provider. This is used to identify the DCR provider in the Portal UI.
      - `provider_type` 'auth0' | 'azureAd' | 'curity' | 'okta' | 'http', required — The type of DCR provider.
    - `labels` Labels, required — Labels store metadata of an entity that can be used for filtering an entity list or for searching across entity types. Keys must be of length 1-63 characters, and cannot start with "kong", "konnect", "mesh", "kic", or "_".
    - `created_at` string, date-time, required — An ISO-8601 timestamp representation of entity creation date.
    - `updated_at` string, date-time, required — An ISO-8601 timestamp representation of entity update date.
  - object — Response payload from creating an OIDC Application Auth Strategy
    - `id` string, uuid, required — Contains a unique identifier used for this resource.
    - `name` string, required — The name of the auth strategy. This is used to identify the auth strategy in the Konnect UI.
    - `display_name` string, required — The display name of the Auth strategy. This is used to identify the Auth strategy in the Portal UI.
    - `strategy_type` 'openid_connect', required
    - `configs` object, required — JSON-B object containing the configuration for the OIDC strategy
      - `openid-connect` AppAuthStrategyConfigOpenIDConnect, required — A more advanced mode to configure an API Product Version’s Application Auth Strategy. Using this mode will allow developers to use API credentials issued from an external IdP that will authenticate their application requests. Once authenticated, an application will be granted access to any Product Version it is registered for that is configured for the same Auth Strategy. An OIDC strategy may be used in conjunction with a DCR provider to automatically create the IdP application.
        - `issuer` string, url, required
        - `credential_claim` string[], required
        - `scopes` string[], required
        - `auth_methods` string[], required
    - `active` boolean, required — At least one published entity is using this auth strategy.
    - `dcr_provider` object, nullable, required
      - `id` string, uuid, required — Contains a unique identifier used for this resource.
      - `name` string, required
      - `display_name` string — The display name of the DCR provider. This is used to identify the DCR provider in the Portal UI.
      - `provider_type` 'auth0' | 'azureAd' | 'curity' | 'okta' | 'http', required — The type of DCR provider.
    - `labels` Labels, required — Labels store metadata of an entity that can be used for filtering an entity list or for searching across entity types. Keys must be of length 1-63 characters, and cannot start with "kong", "konnect", "mesh", "kic", or "_".
    - `created_at` string, date-time, required — An ISO-8601 timestamp representation of entity creation date.
    - `updated_at` string, date-time, required — An ISO-8601 timestamp representation of entity update date.

## Other responses

- `400` — Bad Request
- `401` — Unauthorized
- `403` — Forbidden
- `404` — Not Found

## Changes

- **2025-10-29** `19e869275e28` — 1 warning
  - added the new `type` enum value to the `allOf[subschema #2]/invalid_parameters/items/oneOf[#/components/schemas/InvalidParameterStandard]/rule` response property for the response status `400`
- **2025-08-22** `96118a9cd7f4` — 10 breaking, 1 info
  - removed `subschema #1, subschema #2` from the `configs` request property `oneOf` list
  - the response property `allOf[subschema #2]/invalid_parameters/items/oneOf[#/components/schemas/InvalidParameterChoiceItem]/source` became nullable for the status `400`
  - the response property `allOf[subschema #2]/invalid_parameters/items/oneOf[#/components/schemas/InvalidParameterDependentItem]/source` became nullable for the status `400`
  - the response property `allOf[subschema #2]/invalid_parameters/items/oneOf[#/components/schemas/InvalidParameterMaximumLength]/source` became nullable for the status `400`
  - …7 more
- **2025-02-10** `d833d4dbb1fa` — 1 warning
  - added the new `missing_reference` enum value to the `allOf[subschema #2]/invalid_parameters/items/oneOf[#/components/schemas/InvalidParameterStandard]/rule` response property for the response status `400`
- …earlier changes not shown

[Full history](https://skmtc.dev/kong/apis/konnect-api/changes/v2/application-auth-strategies/:authStrategyId/patch.md)

---

[API](https://skmtc.dev/kong/apis/konnect-api.md) · [All operations](https://skmtc.dev/kong/apis/konnect-api/llms.txt) · [OpenAPI document](https://skmtc-service-production.skmtc.workers.dev/v1/apis/kong/konnect-api/revisions/ad02b4e24eb2/schema)