Update a credential

POST /api/v1/cloud/vaults/{vault_id}/credentials/{credential_id} Updates an active Vault credential in place. The request is a merge-style patch: omitted fields keep their current values. Use it to rotate secrets without recreating the credential.

Path parameters

Parameter	Type	Description
`vault_id`	string	Vault ID with the `vault_` prefix
`credential_id`	string	Credential ID with the `vcred_` prefix

Headers

Header	Required	Description
`Authorization`	Yes	`Bearer <PAT or SAT>`
`Content-Type`	Yes	`application/json`

Request body

Field	Type	Required	Description
`auth`	object	No	Credential auth patch. `auth.type` is required and must match the credential's existing type
`metadata`	object	No	Metadata merge patch. Setting a key to `null` removes it; sending `"metadata": null` resets metadata to `{}`

Updatable `auth` fields by type

Credential type	Updatable fields
`static_bearer`	`token`
`mcp_oauth`	`access_token`, `expires_at` (`null` clears it), `refresh.refresh_token`, `refresh.scope` (`null` clears it), `refresh.token_endpoint_auth`
`environment_variable`	`secret_value`

Identity fields are immutable: auth.type, mcp_server_url, secret_name, refresh.client_id, and refresh.token_endpoint cannot change. auth.refresh can only patch an existing refresh configuration; it cannot add one to a credential created without it.

Example request

Rotate the access token of an mcp_oauth credential:

curl -X POST "https://api.qoder.com/api/v1/cloud/vaults/vault_019e3bb940277f0db05ab74291acf6ef/credentials/vcred_019e3bb98877759e862750b495c1fce8" \
  -H "Authorization: Bearer $QODER_PAT" \
  -H "Content-Type: application/json" \
  -d '{
    "auth": {
      "type": "mcp_oauth",
      "access_token": "new-oauth-access-token",
      "expires_at": "2026-08-20T08:00:00Z"
    },
    "metadata": {"rotated_by": "ops", "stale_flag": null}
  }'

Example response

HTTP 200 OK

{
  "id": "vcred_019e3bb98877759e862750b495c1fce8",
  "type": "vault_credential",
  "vault_id": "vault_019e3bb940277f0db05ab74291acf6ef",
  "auth": {
    "type": "mcp_oauth",
    "mcp_server_url": "https://mcp.example.com/mcp",
    "expires_at": "2026-08-20T08:00:00Z"
  },
  "display_name": null,
  "metadata": {"rotated_by": "ops"},
  "archived_at": null,
  "created_at": "2026-05-18T15:34:35.387093Z",
  "updated_at": "2026-08-19T02:58:10.114532Z"
}

The response is the sanitized credential view; secret values (token, access_token, refresh_token, client_secret, secret_value) are never returned.

Errors

HTTP	Type	Trigger
400	`invalid_request_error`	`auth.type` missing or different from the credential's type, invalid field value, or patching `refresh` on a credential without refresh configuration
404	`not_found_error`	Vault or credential does not exist or is not accessible
409	`conflict_error`	Credential is archived

Notes

Secrets passed in the patch replace the stored values immediately; there is no versioning.
After rotating an mcp_oauth access token, run Validate an MCP OAuth credential to confirm the new token works.

​Path parameters

​Headers

​Request body

​Updatable auth fields by type

​Example request

​Example response

​Errors

​Notes