---
title: "Rotate credentials or set the public URL"
method: PATCH
path: "/storage/{id}"
tags: ["Storage"]
---

# Rotate credentials or set the public URL

`PATCH /storage/{id}`

New credentials are probed before they replace the old ones. Rotation is this update; there is no separate rotate call.

## Path parameters

- `id` string, required

## Request body

- object
  - `credentials` union
    - object
      - `type` 'keys', required
      - `accessKeyId` string, required
      - `secretAccessKey` string, required
    - object
      - `type` 'cloudflare-token', required
      - `token` string, required
    - object
      - `type` 'aws-role', required
      - `roleArn` string, required
    - object
      - `type` 'supabase-session', required
      - `anonKey` string, required
      - `sessionToken` string, required
  - `publicBaseUrl` string, uri, nullable
  - `pathTemplate` string
  - `onConflict` 'suffix' | 'replace'
  - `defaultDestination` boolean

## Response `200`

Updated

- object
  - `data` object, required
    - `bucket` string, required
    - `publicBaseUrl` string, uri
    - `endpoint` string, uri, required
    - `region` string, required
    - `pathStyle` boolean, required
    - `accountId` string
    - `jurisdiction` 'eu' | 'fedramp' | 'us'
    - `projectRef` string
    - `expiresOn` number
    - `pending` true
    - `auth` 'role'
    - `access` 'read'
    - `problem` object
      - `at` number, required
      - `message` string, required
    - `pathTemplate` string
    - `onConflict` 'suffix' | 'replace'
    - `defaultDestination` true
    - `conditionalWrites` boolean
    - `id` string, required
    - `provider` string, required
    - `createdAt` number, required
    - `updatedAt` number, required
    - `deliverySummary` object
      - `jobsLast30d` integer, required
      - `bytesLast30d` integer, required
      - `lastAt` number, nullable, required
      - `lastStatus` 'delivered' | 'failed' | 'null', nullable, required
      - `lastReason` 'destination_denied' | 'signature_mismatch' | 'bucket_not_found' | 'object_too_large' | 'already_exists' | 'destination_unavailable' | 'not_deliverable' | 'null', nullable, required
    - `checks` object[]
      - `name` 'write' | 'read' | 'delete' | 'list', required
      - `status` 'passed' | 'failed' | 'skipped', required
      - `reason` 'destination_denied' | 'signature_mismatch' | 'bucket_not_found' | 'object_too_large' | 'already_exists' | 'destination_unavailable' | 'not_deliverable'
      - `message` string

## Other responses

- `400` — Invalid body, or the write probe failed
- `401` — Unauthorized
- `403` — Missing scope or role
- `404` — Not found

## Changes

- **2026-09-13** `e2df91eff7a2` — 1 info
  - endpoint added

[Change history](https://skmtc.dev/rendobar/apis/rendobar-api/changes/storage/:id/patch.md)

---

[API](https://skmtc.dev/rendobar/apis/rendobar-api.md) · [All operations](https://skmtc.dev/rendobar/apis/rendobar-api/llms.txt) · [OpenAPI document](https://skmtc.dev/rendobar/apis/rendobar-api/revisions/e2df91eff7a2?raw)