---
title: "Update credentials"
method: PUT
path: "/credentials/{credentialsId}"
tags: ["credentials"]
---

# Update credentials

`PUT /credentials/{credentialsId}`

Updates the details of the credentials identified by the given `credentialsId`. For AWS credentials with IAM Role ARN, append `?useExternalId=true` to generate a Platform-managed External ID.

## Path parameters

- `credentialsId` string, required

## Query parameters

- `workspaceId` integer
- `useExternalId` boolean

## Request body

- UpdateCredentialsRequest
  - `credentials` Credentials
    - `baseUrl` string, nullable
    - `category` string, nullable
    - `dateCreated` string, date-time
    - `deleted` boolean, nullable
    - `description` string, nullable
    - `id` string
    - `keys` union
      - object
        - `discriminator` string
        - `accessKey` string, nullable
        - `assumeRoleArn` string, nullable
        - `externalId` string, nullable
        - `mode` 'keys' | 'role' | 'workloadIdentity'
        - `secretKey` string
      - object
        - `discriminator` string
        - `data` string
        - `serviceAccountEmail` string
        - `tokenAudience` string
        - `workloadIdentityProvider` string
      - object
        - `discriminator` string
        - `password` string
        - `token` string
        - `username` string
      - object
        - `discriminator` string
        - `appId` string
        - `clientId` string
        - `clientSecret` string
        - `privateKey` string
        - `slug` string
        - `webhookSecret` string
      - object
        - `discriminator` string
        - `password` string
        - `token` string
        - `username` string
      - object
        - `discriminator` string
        - `password` string
        - `token` string
        - `username` string
      - object
        - `discriminator` string
        - `password` string
        - `token` string
        - `username` string
      - object
        - `discriminator` string
        - `passphrase` string
        - `privateKey` string
      - object
        - `discriminator` string
        - `certificate` string
        - `privateKey` string
        - `token` string
      - object
        - `discriminator` string
        - `batchKey` string
        - `batchName` string
        - `storageKey` string
        - `storageName` string
      - object
        - `discriminator` string
        - `batchKey` string
        - `batchName` string
        - `clientId` string
        - `clientSecret` string
        - `storageKey` string
        - `storageName` string
        - `subscriptionId` string
        - `tenantId` string
      - object
        - `discriminator` string
        - `password` string
        - `token` string
        - `username` string
      - object
        - `discriminator` string
        - `password` string
        - `registry` string
        - `userName` string
      - object
        - `discriminator` string
        - `connectionId` string
        - `shared` boolean
        - `workDir` string
      - object
        - `discriminator` string
        - `password` string
        - `token` string
        - `username` string
      - object
        - `discriminator` string
        - `batchKey` string
        - `batchName` string
        - `clientId` string
        - `clientSecret` string
        - `storageKey` string
        - `storageName` string
        - `tenantId` string
      - object
        - `discriminator` string
        - `accessKey` string, nullable
        - `assumeRoleArn` string, nullable
        - `externalId` string, nullable
        - `mode` 'keys' | 'role' | 'workloadIdentity'
        - `secretKey` string
      - object
        - `discriminator` string
        - `accessKey` string
        - `pathStyleAccessEnabled` boolean
        - `secretKey` string
      - object
        - `discriminator` string
        - `password` string
    - `lastUpdated` string, date-time
    - `lastUsed` string, date-time, nullable
    - `lastValidated` string, date-time, nullable — Timestamp of the most recent completed validation probe (success or authoritative fail). Null until first probe. NOT advanced on transient probe outcomes.
    - `message` string, nullable — Provider-supplied error detail captured when status transitions to INVALID. Cleared (null) whenever status returns to AVAILABLE. Truncated to 4096 characters with a trailing " (truncated)" suffix when the underlying provider message exceeds that limit.
    - `name` string, required
    - `provider` 'aws' | 'azure' | 'azure_entra' | 'google' | 'github' | 'github_app' | 'gitlab' | 'bitbucket' | 'ssh' | 'k8s' | 'container-reg' | 'tw-agent' | 'codecommit' | 'gitea' | 'azurerepos' | 'seqeracompute' | 'azure-cloud' | 's3', required
    - `status` 'AVAILABLE' | 'INVALID'

## Response `204`

OK - No content

## Other responses

- `400` — Bad request
- `403` — Operation not allowed

## Changes

> 14 revisions in range; 1 not diffed, 3 could not be searched.

- **2026-04-20** `b2b5cc41d473` — 6 info
  - added the new optional request property `credentials/keys/oneOf[subschema #2: Google credentials]/serviceAccountEmail`
  - added the new optional request property `credentials/keys/oneOf[subschema #2: Google credentials]/tokenAudience`
  - added the new optional request property `credentials/keys/oneOf[subschema #2: Google credentials]/workloadIdentityProvider`
  - added `github_app` discriminator mapping keys to the `credentials/keys` request property
  - …2 more
- **2026-03-10** `49c99a6944de` — 5 info
  - added the new optional `query` request parameter `useExternalId`
  - added the new optional request property `credentials/keys/oneOf[subschema #16: Seqera Compute credentials]/externalId`
  - added the new optional request property `credentials/keys/oneOf[subschema #16: Seqera Compute credentials]/mode`
  - added the new optional request property `credentials/keys/oneOf[subschema #1: AWS credentials]/externalId`
  - …1 more
- …earlier changes not shown

[Full history](https://skmtc.dev/seqeralabs/apis/seqera-api/changes/credentials/:credentialsId/put.md)

---

[API](https://skmtc.dev/seqeralabs/apis/seqera-api.md) · [All operations](https://skmtc.dev/seqeralabs/apis/seqera-api/llms.txt) · [OpenAPI document](https://skmtc-service-production.skmtc.workers.dev/v1/apis/seqeralabs/seqera-api/revisions/97f7655d105a/schema)