Update a Credential changedapi/beta/vaults/credentials/update
Nearest release: v2.1.304, published 6 hours before this site recorded the change. Shown because the two are within 24 hours of each other. Nothing here says the release caused the edit.
Recorded here
Lines+30added
Lines−18removed
From line
1
where the diff opens
First seen
14 Aug 2026
this site's first read of the page
Recorded edits20to this page, all time
# Update a Credential # Update Credential
The whole hunk
from line 1, old and new numbered
/
from line 1
11---
2title: Update Credential
2title: Update a Credential
33url: https://platform.claude.com/docs/en/api/beta/vaults/credentials/update
44---
55
6# Update Credential
6# Update a Credential
77
88**POST** `/v1/vaults/{vault_id}/credentials/{credential_id}`
99
10Update Credential
10Update a Credential
1111
1212## Path parameters
1313
from line 145
145145
146146- `auth: optional BetaManagedAgentsMCPOAuthUpdateParams or BetaManagedAgentsStaticBearerUpdateParams or BetaManagedAgentsEnvironmentVariableUpdateParams`
147147
148 Updated authentication configuration. The `type` is immutable; the variant sent must match the stored credential's type.
148 New authentication settings for the credential. The `type` must match the credential's current type, which can't be changed.
149149
150150 - `BetaManagedAgentsMCPOAuthUpdateParams object`
151151
from line 155
155155
156156 - `access_token: optional string or null`
157157
158 Updated OAuth access token.
158 The new OAuth access token to replace the stored one.
159159
160160 minLength: 1, maxLength: 8192
161161
162162 - `expires_at: optional string or null`
163163
164 A timestamp in RFC 3339 format
164 When the credential's access token expires, in RFC 3339. Leave it out to keep the stored expiry.
165165
166 If you send a new `access_token`, send its `expires_at` too, or the new token keeps the old expiry.
167
168 Must be in the future.
169
166170 format: date-time
167171
168172 - `refresh: optional BetaManagedAgentsMCPOAuthRefreshUpdateParams or null`
from line 175
171175
172176 - `refresh_token: optional string or null`
173177
174 Updated OAuth refresh token.
178 The new OAuth refresh token to replace the stored one.
175179
176180 minLength: 1, maxLength: 8192
177181
178182 - `scope: optional string or null`
179183
180 Updated OAuth scope for the refresh request.
184 The new OAuth scope for refresh requests. Send an empty string to clear the stored scope.
181185
182186 maxLength: 8192
183187
from line 195
191195
192196 - `client_secret: optional string or null`
193197
194 Updated OAuth client secret.
198 A new OAuth client secret to replace the stored one.
195199
200 The credential must already use `client_secret_basic` or `client_secret_post`. It keeps its current `token_endpoint_auth` type, even if the `type` sent with this secret is the other one.
201
196202 minLength: 1, maxLength: 512
197203
198204 - `BetaManagedAgentsTokenEndpointAuthPostUpdateParam object`
from line 209
203209
204210 - `client_secret: optional string or null`
205211
206 Updated OAuth client secret.
212 A new OAuth client secret to replace the stored one.
207213
214 The credential must already use `client_secret_basic` or `client_secret_post`. It keeps its current `token_endpoint_auth` type, even if the `type` sent with this secret is the other one.
215
208216 minLength: 1, maxLength: 512
209217
210218 - `BetaManagedAgentsStaticBearerUpdateParams object`
from line 223
215223
216224 - `token: optional string or null`
217225
218 Updated static bearer token value.
226 The new static bearer token to replace the stored one.
219227
220228 minLength: 1, maxLength: 8192
221229
from line 247
239247
240248 - `networking: optional BetaManagedAgentsCredentialNetworkingParams or null`
241249
242 Updated networking scope. Full replacement.
250 The new networking scope, which replaces the stored one as a whole.
243251
244252 - `BetaManagedAgentsUnrestrictedCredentialNetworkingParams object`
245253
from line 263
255263
256264 - `allowed_hosts: array of string`
257265
258 Hostnames on which the secret will be substituted. Each entry is a bare hostname (`api.example.com`), an IPv4 address (`192.0.2.1`), or a `*.`-prefixed wildcard (`*.example.com`). URLs, ports, paths, and IPv6 addresses are not accepted. At most 16 entries.
266 The destination hosts of the outbound requests that the credential's secret is substituted into.
259267
268 Each entry is a bare hostname (`api.example.com`), an IPv4 address (`192.0.2.1`), or a `*.` wildcard (`*.example.com`). URLs, ports, paths, and IPv6 addresses aren't accepted. The list can have up to 16 entries.
269
260270 - `secret_value: optional string or null`
261271
262 Updated secret value.
272 The new secret value to replace the stored one.
263273
264274 minLength: 1, maxLength: 4096
265275
from line 293
283293
284294 - `id: string`
285295
286 Unique identifier for the credential.
296 The unique ID of the credential (`vcrd_...`).
287297
288298 - `archived_at: string or null`
289299
from line 317
307317
308318 - `expires_at: optional string or null`
309319
310 A timestamp in RFC 3339 format
320 When the credential's access token expires, in RFC 3339. Absent if the expiry isn't known.
311321
312322 format: date-time
313323
from line 327
317327
318328 - `client_id: string`
319329
320 OAuth client ID.
330 The OAuth client ID used when refreshing the access token.
321331
322332 - `token_endpoint: string`
323333
from line 407
397407
398408 - `allowed_hosts: array of string`
399409
400 Hostnames on which the secret will be substituted. An entry matches the request host exactly; a `*.`-prefixed entry matches any subdomain of the named domain but not the domain itself.
410 The destination hosts of the outbound requests that the credential's secret is substituted into.
411
412 An entry matches the request host exactly. An entry such as `*.example.com` matches any subdomain of `example.com` but not `example.com` itself.
401413
402414 - `secret_name: string`
403415
No line in this hunk matches that.