---
title: "Change a scoped Agent Connection's tool set"
method: PATCH
path: "/credits/agent-connections/{connectionId}"
tags: ["Authentication", "MCP"]
---

# Change a scoped Agent Connection's tool set

`PATCH /credits/agent-connections/{connectionId}`

## Request

- Base URL: `https://api.paywithlocus.com/api`
- URL: `https://api.paywithlocus.com/api/credits/agent-connections/{connectionId}`
- Auth: one of:
  - HTTP bearer
  - HTTP bearer

Moves the credential to another tool set (null moves it to Main). The lcac_ value does not change and the next call uses the new set. A credential that still carries a hand-picked tool list can only move to a list that has every one of those tools on. Callers require credentials:manage and credits:move; a scoped secret key with both may automate this operation, while human callers additionally require owner/admin step-up.

## Path parameters

- `connectionId` string, uuid, required

## Headers

- `X-Locus-Step-Up` string, password

## Request body

- object
  - `toolSetId` string, uuid, nullable, required: A tool set id from GET /credits/tool-sets, or null for Main.

## Response `200`

Connection metadata with the new toolSetId; the raw credential is omitted

- AgentConnectionEnvelope
  - `success` unknown, required
  - `connection` AgentConnection, required
    - `id` string, uuid, required
    - `name` string, required
    - `status` 'active' | 'expired' | 'revoked', required
    - `mode` 'platform' | 'end_user', required
    - `externalUserId` string: Case-sensitive immutable ID in the tenant namespace. Prefer an identity-provider subject, not an email address.
    - `tools` object
      - `enable` string[], nullable
    - `pricing` CredentialPricingPolicy
      - `markupBps` integer
      - `flatMarkupUsdc` string: Non-negative exact decimal string with at most six fractional digits. Endpoint-specific positivity and amount limits still apply.
      - `endpoints` object
    - `maxCreditsPerCall` string: Non-negative exact decimal string with at most six fractional digits. Endpoint-specific positivity and amount limits still apply.
    - `maxCreditsPerLoop` string: Non-negative exact decimal string with at most six fractional digits. Endpoint-specific positivity and amount limits still apply.
    - `keyPrefix` string, required
    - `expiresAt` string, date-time, required
    - `revokedAt` string, date-time, nullable
    - `rotatedAt` string, date-time, nullable
    - `lastUsedAt` string, date-time, nullable
    - `createdAt` string, date-time, required
    - `updatedAt` string, date-time, required
    - `mcp` object, required
      - `url` string, uri, required
      - `headers` object
    - `credential` string: Present only in create/rotate responses and shown once

## Other responses

- `400`: Missing toolSetId, an unknown field, no live tool set with that id, or the credential's tools are off in the target list
- `401`: Missing, invalid, expired, or revoked management credential
- `403`: The authenticated management credential lacks one or more required scopes
- `404`: Connection not found in this workspace
- `409`: Connection is no longer active

---

[API](https://skmtc.dev/paywithlocus/apis/locus-pro-api.md) - [All operations](https://skmtc.dev/paywithlocus/apis/locus-pro-api/llms.txt) - [OpenAPI document](https://skmtc.dev/paywithlocus/apis/locus-pro-api/revisions/aab8fa5d6cef?raw)