---
title: "Update an API credential"
method: PATCH
path: "/v2/api-credentials/{apiCredentialId}"
tags: ["API credentials"]
---

# Update an API credential

`PATCH /v2/api-credentials/{apiCredentialId}`

## Request

- Base URL: `https://api.sigmacomputing.com`
- URL: `https://api.sigmacomputing.com/v2/api-credentials/{apiCredentialId}`
- Auth: HTTP bearer

This endpoint updates one or more fields on an existing API credential. For more information on API credentials, see [Configure API credentials and connectors in Sigma](https://help.sigmacomputing.com/docs/configure-api-credentials-and-connectors-in-sigma).

### Usage notes
- The user making this request must be assigned an account type with the **Manage API connectors** permission enabled and have **Can edit** access to the API credential.
- Retrieve the **apiCredentialId** by calling the [/v2/api-credentials](https://help.sigmacomputing.com/reference/list-api-credentials) endpoint.
- Omitted fields are left unchanged.
- If a `credential` is provided, the provided authentication details (ID, secret, etc.) replace the previous values. To leave secrets unchanged, omit the `credential` parameter.

### Usage scenarios
- **Secret rotation:** Update the secret fields for a credential automatically for an external service.
- **Allowlist updates:** Expand or restrict the set of hostnames the credential can be used against.

## Path parameters

- `apiCredentialId` string, required

## Request body

- object
  - `name` string: New display name.
  - `description` string, nullable: New description. Pass `null` to clear.
  - `allowlist` string[]: Replacement list of hostname glob patterns. Must not be empty; use `["*"]` to allow every host.
  - `credential` union
    - V2ApiCredentialsApiCredentialIdPatchRequestBodyContentApplicationJsonSchemaCredential0
      - `authMethod` 'basic', required
      - `basic` V2ApiCredentialsApiCredentialIdPatchRequestBodyContentApplicationJsonSchemaCredentialOneOf0Basic, required
        - `username` string, required: Username for Basic authentication.
        - `password` string, required: Password for Basic authentication. Encrypted at rest; never returned in responses.
    - V2ApiCredentialsApiCredentialIdPatchRequestBodyContentApplicationJsonSchemaCredential1
      - `authMethod` 'bearer', required
      - `bearer` V2ApiCredentialsApiCredentialIdPatchRequestBodyContentApplicationJsonSchemaCredentialOneOf1Bearer, required
        - `token` string, required: Bearer token. Encrypted at rest; never returned in responses.
    - V2ApiCredentialsApiCredentialIdPatchRequestBodyContentApplicationJsonSchemaCredential2
      - `authMethod` 'apiKey', required
      - `apiKey` V2ApiCredentialsApiCredentialIdPatchRequestBodyContentApplicationJsonSchemaCredentialOneOf2ApiKey, required
        - `key` string, required: Header or query parameter name carrying the API key.
        - `value` string, required: API key value. Encrypted at rest; never returned in responses.
        - `isQueryParam` boolean, required: Whether the key is sent as a query parameter; if false, it is sent as a header.
    - V2ApiCredentialsApiCredentialIdPatchRequestBodyContentApplicationJsonSchemaCredential3
      - `authMethod` 'oAuthClientCredentials', required
      - `oAuthClientCredentials` V2ApiCredentialsApiCredentialIdPatchRequestBodyContentApplicationJsonSchemaCredentialOneOf3OAuthClientCredentials, required
        - `clientId` string, required: OAuth client ID.
        - `clientSecret` string, required: OAuth client secret. Encrypted at rest; never returned in responses.
        - `accessTokenUrl` string, required: OAuth token endpoint URL.
        - `scopes` string[], required: OAuth scopes requested at token exchange.
        - `accessTokenAuthMethod` 'httpBasic' | 'requestBody', required: How client credentials are presented to the token endpoint.
    - V2ApiCredentialsApiCredentialIdPatchRequestBodyContentApplicationJsonSchemaCredential4
      - `authMethod` 'awsSigV4', required
      - `awsSigV4` V2ApiCredentialsApiCredentialIdPatchRequestBodyContentApplicationJsonSchemaCredentialOneOf4AwsSigV4, required
        - `accessKeyId` string, required: AWS access key ID.
        - `secretAccessKey` string, required: AWS secret access key. Encrypted at rest; never returned in responses.
        - `region` string: AWS region for SigV4 signing.
        - `service` string: AWS service name for SigV4 signing (e.g. `s3`, `execute-api`).
        - `sessionToken` string: AWS STS session token for temporary credentials.
        - `temporaryCredentialsUrl` string: URL that vends temporary credentials (e.g. STS AssumeRole endpoint).
        - `temporaryCredentialsResponseMapping` V2ApiCredentialsApiCredentialIdPatchRequestBodyContentApplicationJsonSchemaCredentialOneOf4AwsSigV4TemporaryCredentialsResponseMapping
          - `accessKeyField` string
          - `secretKeyField` string
          - `sessionTokenField` string
          - `expirationField` string
        - `temporaryCredentialsRequestParams` V2ApiCredentialsApiCredentialIdPatchRequestBodyContentApplicationJsonSchemaCredentialOneOf4AwsSigV4TemporaryCredentialsRequestParamsItems[]: Additional key/value parameters attached to the temporary-credentials swap request. Each entry specifies whether it is sent as a request header, body field, or query parameter (`sendIn`: `header` | `body` | `queryParam`). Use this when the swap endpoint requires its own authentication (for example, an `x-api-key` header).
          - `key` string, required
          - `value` string, required
          - `sendIn` 'queryParam' | 'body' | 'header', required

## Response `200`

The response body.

- ApiCredentialsUpdateApiCredentialResponse200
  - `apiCredentialId` string, required: Unique identifier of the API credential.
  - `name` string, required: Display name of the credential.
  - `authMethod` 'basic' | 'bearer' | 'apiKey' | 'oAuthClientCredentials' | 'oAuthAuthorizationCode' | 'oAuthPasswordCredentials' | 'awsSigV4', required: Authentication method the credential uses.
  - `allowlist` string[], required: Hostname glob patterns (e.g. `*.example.com`) that the credential is authorized to be used against.
  - `credential` union, required: Nonsensitive projection of the credential, discriminated by `authMethod`. Secret fields (password, token, clientSecret, secretAccessKey) are never returned.
    - V2ApiCredentialsApiCredentialIdPatchResponsesContentApplicationJsonSchemaCredential0
      - `authMethod` 'basic', required
      - `basic` V2ApiCredentialsApiCredentialIdPatchResponsesContentApplicationJsonSchemaCredentialOneOf0Basic
        - `username` string, required: Username for Basic authentication.
    - V2ApiCredentialsApiCredentialIdPatchResponsesContentApplicationJsonSchemaCredential1
      - `authMethod` 'bearer', required
    - V2ApiCredentialsApiCredentialIdPatchResponsesContentApplicationJsonSchemaCredential2
      - `authMethod` 'apiKey', required
      - `apiKey` V2ApiCredentialsApiCredentialIdPatchResponsesContentApplicationJsonSchemaCredentialOneOf2ApiKey
        - `key` string, required: Header or query parameter name carrying the API key.
        - `isQueryParam` boolean, required: Whether the key is sent as a query parameter; if false, it is sent as a header.
    - V2ApiCredentialsApiCredentialIdPatchResponsesContentApplicationJsonSchemaCredential3
      - `authMethod` 'oAuthClientCredentials', required
      - `oAuthClientCredentials` V2ApiCredentialsApiCredentialIdPatchResponsesContentApplicationJsonSchemaCredentialOneOf3OAuthClientCredentials
        - `clientId` string, required: OAuth client ID.
        - `accessTokenUrl` string, required: OAuth token endpoint URL.
        - `scopes` string[], required: OAuth scopes requested at token exchange.
        - `accessTokenAuthMethod` 'httpBasic' | 'requestBody', required: How client credentials are presented to the token endpoint.
    - V2ApiCredentialsApiCredentialIdPatchResponsesContentApplicationJsonSchemaCredential4
      - `authMethod` 'oAuthAuthorizationCode', required
      - `oAuthAuthorizationCode` V2ApiCredentialsApiCredentialIdPatchResponsesContentApplicationJsonSchemaCredentialOneOf4OAuthAuthorizationCode
        - `clientId` string, required: OAuth client ID.
        - `authorizationUrl` string, required: OAuth authorization endpoint URL.
        - `accessTokenUrl` string, required: OAuth token endpoint URL.
        - `scopes` string[], required: OAuth scopes.
        - `accessTokenAuthMethod` 'httpBasic' | 'requestBody', required: How client credentials are presented to the token endpoint.
    - V2ApiCredentialsApiCredentialIdPatchResponsesContentApplicationJsonSchemaCredential5
      - `authMethod` 'oAuthPasswordCredentials', required
      - `oAuthPasswordCredentials` V2ApiCredentialsApiCredentialIdPatchResponsesContentApplicationJsonSchemaCredentialOneOf5OAuthPasswordCredentials
        - `username` string, required: OAuth resource-owner username.
        - `accessTokenUrl` string, required: OAuth token endpoint URL.
        - `scopes` string[], required: OAuth scopes.
        - `accessTokenAuthMethod` 'httpBasic' | 'requestBody', required: How client credentials are presented to the token endpoint.
        - `clientId` string: OAuth client ID.
    - V2ApiCredentialsApiCredentialIdPatchResponsesContentApplicationJsonSchemaCredential6
      - `authMethod` 'awsSigV4', required
      - `awsSigV4` V2ApiCredentialsApiCredentialIdPatchResponsesContentApplicationJsonSchemaCredentialOneOf6AwsSigV4
        - `accessKeyId` string, required: AWS access key ID.
        - `region` string: AWS region for SigV4 signing.
        - `service` string: AWS service name for SigV4 signing (e.g. `s3`, `execute-api`).
        - `temporaryCredentialsUrl` string: URL that vends temporary credentials (e.g. STS AssumeRole endpoint).
        - `temporaryCredentialsResponseMapping` V2ApiCredentialsApiCredentialIdPatchResponsesContentApplicationJsonSchemaCredentialOneOf6AwsSigV4TemporaryCredentialsResponseMapping
          - `accessKeyField` string
          - `secretKeyField` string
          - `sessionTokenField` string
          - `expirationField` string
        - `temporaryCredentialsRequestParams` V2ApiCredentialsApiCredentialIdPatchResponsesContentApplicationJsonSchemaCredentialOneOf6AwsSigV4TemporaryCredentialsRequestParamsItems[]: Additional parameters sent on the temporary-credentials swap request, each tagged with `sendIn` (`header` | `body` | `queryParam`).
          - `key` string, required
          - `value` string, required
          - `sendIn` 'queryParam' | 'body' | 'header', required
  - `createdBy` string, required: The identifier of the user who created this object.
  - `updatedBy` string, required: The identifier of the user or process that last updated this object.
  - `createdAt` string, date-time, required: When the object was created.
  - `updatedAt` string, date-time, required: When the object was last updated.
  - `description` string: Human-readable description.

---

[API](https://skmtc.dev/sigmacomputing/apis/sigma-rest-api.md) - [All operations](https://skmtc.dev/sigmacomputing/apis/sigma-rest-api/llms.txt) - [OpenAPI document](https://skmtc.dev/sigmacomputing/apis/sigma-rest-api/revisions/fb6036208c49?raw)