---
title: "PUT /vault/credentials/{id}"
method: PUT
path: "/vault/credentials/{id}"
---

# PUT /vault/credentials/{id}

`PUT /vault/credentials/{id}`

## Request

- Base URL: `https://api.useanima.sh/v1`
- URL: `https://api.useanima.sh/v1/vault/credentials/{id}`
- Auth: one of:
  - HTTP bearer
  - API key in header `X-API-Key`

## Path parameters

- `id` string, required: Credential identifier

## Request body

- object
  - `agentId` union: Agent identifier. Optional when using an agent API key (resolved automatically); required when using a master key.
    - string
    - string
  - `reveal` boolean: Return unmasked plaintext fields. Requires master key auth. Audit-logged as 'access_reveal'.
  - `name` string: Updated display name
  - `notes` string: Updated notes
  - `login` object: Login patch. Fields you omit keep their stored values; a masked echo (e.g. '****') of password/totp also counts as unchanged.
    - `username` string: Login username or email
    - `password` string: Login password
    - `uris` object[]: URIs associated with this login
      - `uri` string, required: URI associated with the credential
      - `match` 'domain' | 'host' | 'starts_with' | 'regex' | 'never': URI matching strategy for auto-fill
    - `totp` string: TOTP secret for two-factor authentication
  - `card` object: Updated card data
    - `cardholderName` string: Name on the payment card
    - `brand` string: Card brand (e.g. Visa, Mastercard)
    - `number` string: Full card number
    - `expMonth` string: Card expiration month
    - `expYear` string: Card expiration year
    - `code` string: Card security code (CVV/CVC)
  - `identity` object: Updated identity data
    - `firstName` string: First name
    - `lastName` string: Last name
    - `email` string, email: Email address
    - `phone` string: Phone number
    - `address1` string: Street address
    - `city` string: City
    - `state` string: State or province
    - `postalCode` string: Postal or ZIP code
    - `country` string: Country code or name
    - `company` string: Company or organization name
    - `ssn` string: Social security number
  - `oauthToken` object: OAuth token patch. Omitted fields keep their stored values; masked echoes of accessToken/refreshToken/clientSecret count as unchanged.
    - `provider` string: OAuth provider name (e.g. google, github, slack)
    - `accessToken` string: Encrypted OAuth access token
    - `refreshToken` string: Encrypted OAuth refresh token
    - `tokenEndpoint` string: OAuth token endpoint URL for refreshing tokens
    - `clientId` string: Encrypted OAuth client ID
    - `clientSecret` string: Encrypted OAuth client secret
    - `scopes` string[]: OAuth scopes granted to this token
    - `expiresAt` string, date-time: Token expiration timestamp
    - `autoRefresh` boolean: Whether to automatically refresh the token before expiry
    - `allowedHosts` string[]: Hosts this token may be brokered to via server-side use. Fail-closed if empty.
  - `apiKey` object: API key patch. Omitted fields keep their stored values (edit allowedHosts without resending the key); a masked echo of `key` counts as unchanged.
    - `provider` string: API provider name (e.g. openai, anthropic, stripe)
    - `key` string: Encrypted API key
    - `prefix` string: Display prefix for the key (e.g. 'sk-...abc')
    - `rateLimit` object: Rate limit configuration for this key
      - `requests` integer, required: Maximum number of requests allowed
      - `window` string, required: Time window for rate limiting (e.g. '1m', '1h', '1d')
    - `expiresAt` string, date-time: Optional key expiration timestamp
    - `scopes` string[]: Optional scopes or permissions for this key
    - `allowedHosts` string[]: Hosts this key may be brokered to via server-side use. Fail-closed if empty.
    - `authHeader` string: Header the broker injects the key into (default 'Authorization').
    - `authScheme` string: Value prefix before the key (default 'Bearer '; set '' for a raw key, e.g. x-api-key).
  - `certificate` object: Certificate patch. Omitted fields keep their stored values; a masked echo of privateKey counts as unchanged.
    - `format` 'pem' | 'p12' | 'jks': Certificate format
    - `certificate` string: Encrypted certificate content
    - `privateKey` string: Encrypted private key
    - `chain` string[]: Encrypted certificate chain
    - `expiresAt` string, date-time: Certificate expiration timestamp
  - `fields` object[]: Updated custom fields
    - `name` string, required: Field name
    - `value` string, required: Field value
    - `type` 'text' | 'hidden' | 'boolean', required: Field display type
  - `favorite` boolean: Updated favorite status
  - `revealPolicy` 'standard' | 'brokered': Change the reveal policy. Upgrading standard → brokered needs UPDATE access; downgrading brokered → standard requires master-key auth and is audited.

## Response `200`

OK

- object: Full credential record returned from the vault
  - `id` string, required: Unique credential identifier
  - `type` 'login' | 'secure_note' | 'card' | 'identity' | 'oauth_token' | 'api_key' | 'certificate', required: Credential type
  - `name` string, required: User-defined credential name
  - `notes` string: Free-form notes attached to the credential
  - `login` object: Login credential data, present when type is login
    - `username` string: Login username or email
    - `password` string: Login password
    - `uris` object[]: URIs associated with this login
      - `uri` string, required: URI associated with the credential
      - `match` 'domain' | 'host' | 'starts_with' | 'regex' | 'never': URI matching strategy for auto-fill
    - `totp` string: TOTP secret for two-factor authentication
  - `card` object: Card credential data, present when type is card
    - `cardholderName` string: Name on the payment card
    - `brand` string: Card brand (e.g. Visa, Mastercard)
    - `number` string: Full card number
    - `expMonth` string: Card expiration month
    - `expYear` string: Card expiration year
    - `code` string: Card security code (CVV/CVC)
  - `identity` object: Identity credential data, present when type is identity
    - `firstName` string: First name
    - `lastName` string: Last name
    - `email` string, email: Email address
    - `phone` string: Phone number
    - `address1` string: Street address
    - `city` string: City
    - `state` string: State or province
    - `postalCode` string: Postal or ZIP code
    - `country` string: Country code or name
    - `company` string: Company or organization name
    - `ssn` string: Social security number
  - `oauthToken` object: OAuth token data, present when type is oauth_token
    - `provider` string, required: OAuth provider name (e.g. google, github, slack)
    - `accessToken` string, required: Encrypted OAuth access token
    - `refreshToken` string, required: Encrypted OAuth refresh token
    - `tokenEndpoint` string, required: OAuth token endpoint URL for refreshing tokens
    - `clientId` string, required: Encrypted OAuth client ID
    - `clientSecret` string: Encrypted OAuth client secret
    - `scopes` string[], required: OAuth scopes granted to this token
    - `expiresAt` string, date-time, required: Token expiration timestamp
    - `autoRefresh` boolean: Whether to automatically refresh the token before expiry
    - `allowedHosts` string[]: Hosts this token may be brokered to via server-side use. Fail-closed if empty.
  - `apiKey` object: API key data, present when type is api_key
    - `provider` string, required: API provider name (e.g. openai, anthropic, stripe)
    - `key` string, required: Encrypted API key
    - `prefix` string: Display prefix for the key (e.g. 'sk-...abc')
    - `rateLimit` object: Rate limit configuration for this key
      - `requests` integer, required: Maximum number of requests allowed
      - `window` string, required: Time window for rate limiting (e.g. '1m', '1h', '1d')
    - `expiresAt` string, date-time: Optional key expiration timestamp
    - `scopes` string[]: Optional scopes or permissions for this key
    - `allowedHosts` string[]: Hosts this key may be brokered to via server-side use. Fail-closed if empty.
    - `authHeader` string: Header the broker injects the key into (default 'Authorization').
    - `authScheme` string: Value prefix before the key (default 'Bearer '; set '' for a raw key, e.g. x-api-key).
  - `certificate` object: Certificate data, present when type is certificate
    - `format` 'pem' | 'p12' | 'jks', required: Certificate format
    - `certificate` string, required: Encrypted certificate content
    - `privateKey` string, required: Encrypted private key
    - `chain` string[]: Encrypted certificate chain
    - `expiresAt` string, date-time, required: Certificate expiration timestamp
  - `fields` object[]: Custom fields attached to the credential
    - `name` string, required: Field name
    - `value` string, required: Field value
    - `type` 'text' | 'hidden' | 'boolean', required: Field display type
  - `favorite` boolean, required: Whether the credential is marked as a favorite
  - `folderId` string: Folder the credential belongs to
  - `organizationId` string: Organization the credential is scoped to
  - `collectionIds` string[]: Collections the credential is shared with
  - `createdAt` string, date-time, required: Timestamp when the credential was created
  - `updatedAt` string, date-time, required: Timestamp when the credential was last updated
  - `revealPolicy` 'standard' | 'brokered': Reveal policy governing whether plaintext may be returned (default 'standard')

---

[API](https://skmtc.dev/useanima/apis/anima-api.md) · [All operations](https://skmtc.dev/useanima/apis/anima-api/llms.txt) · [OpenAPI document](https://skmtc.dev/useanima/apis/anima-api/revisions/aaa148188980?raw)