---
title: "Update IAM credential"
method: PATCH
path: "/v3/iam/principals/{principal_id}/credentials/{credential_id}"
tags: ["IAM credentials"]
---

# Update IAM credential

`PATCH /v3/iam/principals/{principal_id}/credentials/{credential_id}`

## Request

- Base URL: `https://api.us.nylas.com`
- URL: `https://api.us.nylas.com/v3/iam/principals/{principal_id}/credentials/{credential_id}`
- Auth: HTTP bearer

Requires `iam.credentials.update` on an active principal bound to the authenticated organization. Authenticate with an active, unexpired IAM credential of type `api_key`. Application API keys (including legacy API keys) and provider OAuth tokens cannot authorize IAM management endpoints. Use an existing IAM credential with these permissions, or [create your first management credential in the Dashboard](/docs/v3/auth/nylas-iam/manage-principals-with-api/#create-a-management-credential-in-the-dashboard).

Updates only name and/or status. Expiration, type, principal, and secret cannot be changed. Omitted fields stay unchanged. A disabled principal cannot reactivate a credential. Empty bodies, null values, and unknown fields are rejected.

## Request body

- CredentialUpdate
  - `name` string: Descriptive workload name. Surrounding whitespace is removed.
  - `status` 'active' | 'disabled': Whether the principal or credential can authenticate.

## Response `200`

OK

- object
  - `request_id` string: Request ID for troubleshooting.
  - `data` Credential
    - `id` string, required: Opaque credential ID.
    - `principal_id` string, required: ID of the principal that owns this credential.
    - `type` 'api_key', required: Supported IAM credential type.
    - `name` string, required: Descriptive workload name. Surrounding whitespace is removed.
    - `status` 'active' | 'disabled', required: Whether the principal or credential can authenticate.
    - `expires_at` integer, nullable, required: Expiration as an integer number of seconds since the Unix epoch (January 1, 1970 at 00:00:00 UTC). For example, `1799193600` represents January 6, 2027 at 00:00:00 UTC. Newly created credentials always have an expiration.
    - `created_at` integer, required: Unix timestamp in seconds.
    - `updated_at` integer, required: Unix timestamp in seconds.

## Other responses

- `400`: Invalid request or object quota exceeded
- `401`: Invalid, disabled, deleted, or expired authentication credential
- `403`: Missing management permission or organization binding
- `404`: Principal or credential not found in this organization
- `409`: Conflicting principal or credential state
- `429`: Too many requests

## Changes

- **2026-10-10** `fb580f0d35d2`: 1 info
  - endpoint added

[Operation history](https://skmtc.dev/nylas/apis/nylas-api/changes/v3/iam/principals/:principal_id/credentials/:credential_id/patch.md)

---

[API](https://skmtc.dev/nylas/apis/nylas-api.md) - [All operations](https://skmtc.dev/nylas/apis/nylas-api/llms.txt) - [OpenAPI document](https://skmtc.dev/nylas/apis/nylas-api/revisions/7782a3e3ab70?raw)