---
title: "Update a custom API provider"
method: PATCH
path: "/credits/custom-endpoints/{providerId}"
tags: ["Custom APIs"]
---

# Update a custom API provider

`PATCH /credits/custom-endpoints/{providerId}`

## Request

- Base URL: `https://api.paywithlocus.com/api`
- URL: `https://api.paywithlocus.com/api/credits/custom-endpoints/{providerId}`
- Auth: HTTP bearer

Updates provider presentation, SSRF-checked base URL, authentication, or traffic protection. Supplying a new credential rotates the encrypted secret; type=none removes it. Requires the same enterprise owner, scope, and recent step-up controls as creation.

## Path parameters

- `providerId` string, uuid, required

## Request body

- CustomProviderUpdateRequest
  - `name` string
  - `description` string, nullable
  - `baseUrl` string, uri
  - `auth` CustomAuthInput: For type=none, omit credential. For type=header or type=query, supply name.
    - `type` 'bearer' | 'header' | 'query' | 'none', required
    - `name` string: Required for header and query authentication; must be a valid HTTP field name.
    - `prefix` string: Optional value prefix for header or query authentication. Bearer authentication always uses 'Bearer '.
    - `credential` string: Required when creating a bearer, header, or query provider. Omit during an update to retain the encrypted credential. Never returned.
  - `traffic` CustomTrafficPolicyUpdate
    - `requestsPerMinute` integer
    - `maxConcurrency` integer
    - `timeoutSeconds` integer
    - `circuitBreaker` object
      - `failureThreshold` integer
      - `windowSeconds` integer
      - `cooldownSeconds` integer

## Response `200`

Provider updated

- CustomProviderResponse
  - `success` unknown, required
  - `provider` CustomProvider, required
    - `id` string, uuid, required
    - `slug` string, required
    - `publicProvider` string, required: Provider name used in catalog discovery and /wrapped/credits/{provider}/{endpoint}.
    - `name` string, required
    - `description` string, nullable, required
    - `baseUrl` string, uri, nullable, required: Null when upstream configuration is redacted for this caller.
    - `auth` CustomAuthView, required
      - `type` 'bearer' | 'header' | 'query' | 'none' | 'null', nullable, required: Null when upstream configuration is redacted for this caller.
      - `name` string, nullable, required
      - `prefix` string, nullable, required
      - `configured` boolean, required
      - `hint` string, nullable, required: Non-secret credential hint for an authorized owner; never the credential itself.
      - `version` integer, required
      - `updatedAt` string, date-time, nullable, required
    - `traffic` CustomTrafficPolicy, required
      - `requestsPerMinute` integer, required: Must not exceed the platform-wide 60,000 request-per-minute ceiling.
      - `maxConcurrency` integer, required
      - `timeoutSeconds` integer, required
      - `circuitBreaker` CustomCircuitBreakerPolicy, required
        - `failureThreshold` integer, required
        - `windowSeconds` integer, required
        - `cooldownSeconds` integer, required
    - `endpoints` CustomEndpoint[], required
      - `id` string, uuid, required
      - `slug` string, required
      - `publicSlug` string, required: Catalog and execution identity.
      - `name` string, required
      - `description` string, required
      - `method` 'GET' | 'POST' | 'PUT' | 'PATCH' | 'DELETE', required
      - `path` string, required
      - `inputSchema` object, required
      - `inputExample` object, required
      - `outputSchema` object, nullable, required
      - `outputExample` unknown, required
      - `providerCostUsdc` string, required: Non-negative exact decimal string with at most six fractional digits. Endpoint-specific positivity and amount limits still apply.
      - `markupBps` integer, required
      - `flatMarkupUsdc` string, required: Non-negative exact decimal string with at most six fractional digits. Endpoint-specific positivity and amount limits still apply.
      - `endUserPriceUsdc` string, required: Non-negative exact decimal string with at most six fractional digits. Endpoint-specific positivity and amount limits still apply.
      - `enabled` boolean, required
      - `pricingRevision` integer, required
      - `createdAt` string, date-time, required
      - `updatedAt` string, date-time, required
    - `createdAt` string, date-time, required
    - `updatedAt` string, date-time, required

## Other responses

- `400`: No changes or invalid configuration
- `403`: Feature, enterprise plan, owner, scope, or recent step-up requirement not met
- `404`: Custom provider not found in this workspace

---

[API](https://skmtc.dev/paywithlocus/apis/locus-pro-api.md) - [All operations](https://skmtc.dev/paywithlocus/apis/locus-pro-api/llms.txt) - [OpenAPI document](https://skmtc.dev/paywithlocus/apis/locus-pro-api/revisions/aab8fa5d6cef?raw)