---
title: "Enable/disable a screening provider or update its declared lists (owner-only) · 0 credits"
method: PATCH
path: "/api/v1/screening-providers/{id}"
tags: ["BYO-Screening"]
---

# Enable/disable a screening provider or update its declared lists (owner-only) · 0 credits

`PATCH /api/v1/screening-providers/{id}`

## Request

- Base URL: `https://legal.nexusquantum.legal`
- URL: `https://legal.nexusquantum.legal/api/v1/screening-providers/{id}`
- Auth: HTTP bearer

Partial update. The CREDENTIAL IS NOT EDITABLE here: to rotate it, delete the provider and create it again, which leaves a trace instead of silently mutating a third party's key.

## Path parameters

- `id` string, uuid, required

## Request body

- UpdateScreeningProviderRequest: Partial update. The CREDENTIAL CANNOT BE UPDATED HERE: silently mutating a third party's key leaves the row with the same creation date and the same label, and nobody knows when it changed or who changed it. Delete and recreate instead, which leaves a trace. Sending `api_key` returns CREDENTIAL_NOT_EDITABLE.
  - `enabled` boolean
  - `lists` string[]

## Response `200`

Provider updated (no credential).

- ScreeningProvider: The firm's OWN sanctions-screening provider (BYO). Non-secret projection: it NEVER returns the credential, only `key_fingerprint`. Firm-scoped, bound to the key's `firm_owner_id`.
  - `id` string, uuid
  - `label` string: How you will recognise this provider later (1–60).
  - `kind` 'opensanctions_compatible': Shape of the provider's API. Covers any endpoint exposing an equivalent /match.
  - `base_url` string: Your provider's endpoint (validated against SSRF).
  - `key_fingerprint` string, nullable: NON-reversible hash of the credential (e.g. `sha256:a1b2c3d4`). Not head+tail: on a short key, showing start and end reveals almost all of it. The credential itself NEVER leaves.
  - `lists` string[]: The lists YOU declare as contracted. Shown to the reader verbatim. We do NOT verify them: the report says 'according to what your provider covers', never 'this is covered'.
  - `enabled` boolean
  - `last_verified_at` string, date-time, nullable
  - `created_at` string, date-time
  - `updated_at` string, date-time

## Other responses

- `400`: CREDENTIAL_NOT_EDITABLE · INVALID_ENABLED · INVALID_LISTS · NOTHING_TO_UPDATE · INVALID_JSON
- `404`: NOT_FOUND (does not exist or does not belong to your firm)

---

[API](https://skmtc.dev/nexusquantum/apis/nexus-legal-api.md) · [All operations](https://skmtc.dev/nexusquantum/apis/nexus-legal-api/llms.txt) · [OpenAPI document](https://skmtc.dev/nexusquantum/apis/nexus-legal-api/revisions/4084d8d4eb0b?raw)