---
title: "Change the credential policy"
method: PATCH
path: "/credential-policy"
tags: ["Credentials"]
---

# Change the credential policy

`PATCH /credential-policy`

## Request

- Base URL: `https://api.primitive.dev/v1`
- URL: `https://api.primitive.dev/v1/credential-policy`
- Auth: HTTP bearer

Change one or more policy rules. Admins may only tighten the policy; loosening any rule needs an owner. Owners and admins are emailed about every change. Needs the organization's credential features to be enabled; while they are not, this answers 404 feature_disabled.

Person only: a dashboard session. The person's role must hold credential_policy:manage. API keys, agent connection keys and agents are refused.

## Request body

- CredentialsUpdateCredentialPolicyInput
  - `max_key_lifetime_days` integer, nullable
  - `require_key_expiry` boolean
  - `super_admin_key_creators` 'owners_and_admins' | 'owners'
  - `members_may_mint_keys` boolean
  - `allow_org_mail_scope_keys` boolean
  - `cap_agents_below_person` boolean
  - `removal_suspends_created` boolean
  - `oauth_consent_admin_only` boolean
  - `cli_access` 'owners_admins_and_operators' | 'owners_and_admins' | 'all_members' | 'off'

## Response `200`

Success

- object
  - `success` true, required
  - `data` CredentialsUpdateCredentialPolicyResult, required
    - `max_key_lifetime_days` integer, nullable, required
    - `require_key_expiry` boolean, required
    - `super_admin_key_creators` 'owners_and_admins' | 'owners', required
    - `members_may_mint_keys` boolean, required
    - `allow_org_mail_scope_keys` boolean, required
    - `cap_agents_below_person` boolean, required
    - `removal_suspends_created` boolean, required
    - `oauth_consent_admin_only` boolean, required
    - `cli_access` 'owners_admins_and_operators' | 'owners_and_admins' | 'all_members' | 'off'

## Other responses

- `400`: Invalid request parameters
- `401`: Invalid or missing API key
- `403`: Authenticated caller lacks permission for the operation
- `404`: Resource not found
- `429`: Rate limit exceeded. The `ratelimit-*` headers describe the limiter that rejected this request, with its own limit and window, not the API budget that successful responses report. A limiter that reports only a wait sends `Retry-After` alone.

---

[API](https://skmtc.dev/primitive/apis/primitive-api.md) - [All operations](https://skmtc.dev/primitive/apis/primitive-api/llms.txt) - [OpenAPI document](https://skmtc.dev/primitive/apis/primitive-api/revisions/bce409c97acb?raw)