Repository Public
1---2title: Update Credential3url: https://platform.claude.com/docs/en/api/beta/vaults/credentials/update4---56# Update Credential78**POST** `/v1/vaults/{vault_id}/credentials/{credential_id}`910Update Credential1112## Path parameters1314- `vault_id: string`1516- `credential_id: string`1718## Headers1920- `"anthropic-beta": optional array of AnthropicBeta`2122 Optional header to specify the beta version(s) you want to use.2324 - `string`2526 - `"message-batches-2024-09-24" or "prompt-caching-2024-07-31" or "computer-use-2024-10-22" or 43 more`2728 - `"message-batches-2024-09-24"`2930 - `"prompt-caching-2024-07-31"`3132 - `"computer-use-2024-10-22"`3334 - `"computer-use-2025-01-24"`3536 - `"pdfs-2024-09-25"`3738 - `"token-counting-2024-11-01"`3940 - `"token-efficient-tools-2025-02-19"`4142 - `"output-128k-2025-02-19"`4344 - `"files-api-2025-04-14"`4546 - `"mcp-client-2025-04-04"`4748 - `"mcp-client-2025-11-20"`4950 - `"dev-full-thinking-2025-05-14"`5152 - `"interleaved-thinking-2025-05-14"`5354 - `"code-execution-2025-05-22"`5556 - `"extended-cache-ttl-2025-04-11"`5758 - `"context-1m-2025-08-07"`5960 - `"context-management-2025-06-27"`6162 - `"model-context-window-exceeded-2025-08-26"`6364 - `"skills-2025-10-02"`6566 - `"fast-mode-2026-02-01"`6768 - `"output-300k-2026-03-24"`6970 - `"user-profiles-2026-03-24"`7172 - `"user-profiles-2026-08-18"`7374 - `"user-profiles-2026-09-04"`7576 - `"advisor-tool-2026-03-01"`7778 - `"managed-agents-2026-04-01"`7980 - `"cache-diagnosis-2026-04-07"`8182 - `"dreaming-2026-04-21"`8384 - `"thinking-token-count-2026-05-13"`8586 - `"server-side-fallback-2026-06-01"`8788 - `"server-side-fallback-2026-07-01"`8990 - `"fallback-credit-2026-06-01"`9192 - `"fallback-credit-2026-07-01"`9394 - `"agent-memory-2026-07-22"`9596 - `"mid-conversation-tool-changes-2026-07-01"`9798 - `"compact-2026-01-12"`99100 - `"computer-use-2025-11-24"`101102 - `"mcp-tunnels-2026-06-22"`103104 - `"structured-outputs-2025-11-13"`105106 - `"task-budgets-2026-03-13"`107108 - `"thinking-display-updates-2026-08-18"`109110 - `"ce-user-management-2026-07-13"`111112 - `"mid-conversation-output-config-2026-07-01"`113114 - `"thinking-binding-controls-2026-08-01"`115116 - `"mid-conversation-system-clear-at-2026-08-21"`117118 - `"compact-2026-09-04"`119120- `"anthropic-workspace-id": optional string`121122## Body parameters123124- `auth: optional BetaManagedAgentsMCPOAuthUpdateParams or BetaManagedAgentsStaticBearerUpdateParams or BetaManagedAgentsEnvironmentVariableUpdateParams`125126 Updated authentication details for a credential.127128 - `BetaManagedAgentsMCPOAuthUpdateParams object`129130 Parameters for updating an MCP OAuth credential. The `mcp_server_url` is immutable.131132 - `type: "mcp_oauth"`133134 - `access_token: optional string or null`135136 Updated OAuth access token.137138 minLength: 1, maxLength: 8192139140 - `expires_at: optional string or null`141142 A timestamp in RFC 3339 format143144 format: date-time145146 - `refresh: optional BetaManagedAgentsMCPOAuthRefreshUpdateParams or null`147148 Parameters for updating OAuth refresh token configuration.149150 - `refresh_token: optional string or null`151152 Updated OAuth refresh token.153154 minLength: 1, maxLength: 8192155156 - `scope: optional string or null`157158 Updated OAuth scope for the refresh request.159160 maxLength: 8192161162 - `token_endpoint_auth: optional BetaManagedAgentsTokenEndpointAuthBasicUpdateParam or BetaManagedAgentsTokenEndpointAuthPostUpdateParam`163164 - `BetaManagedAgentsTokenEndpointAuthBasicUpdateParam object`165166 Updated HTTP Basic authentication parameters for the token endpoint.167168 - `type: "client_secret_basic"`169170 - `client_secret: optional string or null`171172 Updated OAuth client secret.173174 minLength: 1, maxLength: 512175176 - `BetaManagedAgentsTokenEndpointAuthPostUpdateParam object`177178 Updated POST body authentication parameters for the token endpoint.179180 - `type: "client_secret_post"`181182 - `client_secret: optional string or null`183184 Updated OAuth client secret.185186 minLength: 1, maxLength: 512187188 - `BetaManagedAgentsStaticBearerUpdateParams object`189190 Parameters for updating a static bearer token credential. The `mcp_server_url` is immutable.191192 - `type: "static_bearer"`193194 - `token: optional string or null`195196 Updated static bearer token value.197198 minLength: 1, maxLength: 8192199200 - `BetaManagedAgentsEnvironmentVariableUpdateParams object`201202 Parameters for updating an environment variable credential. `secret_name` is immutable.203204 - `type: "environment_variable"`205206 - `injection_location: optional BetaManagedAgentsInjectionLocationUpdateParams`207208 Updated injection location.209210 - `body: optional boolean`211212 Substitute when the placeholder appears in the request body.213214 - `header: optional boolean`215216 Substitute when the placeholder appears in a request header value.217218 - `networking: optional BetaManagedAgentsCredentialNetworkingParams or null`219220 Updated networking scope. Full replacement.221222 - `BetaManagedAgentsUnrestrictedCredentialNetworkingParams object`223224 Substitute the secret on any host the session's Environment network policy permits egress to. The Environment's network policy is the only boundary on where the secret can reach.225226 - `type: "unrestricted"`227228 - `BetaManagedAgentsLimitedCredentialNetworkingParams object`229230 Substitute the secret only on requests to the listed hosts.231232 - `type: "limited"`233234 - `allowed_hosts: array of string`235236 Hostnames on which the secret will be substituted. Each entry is a bare hostname (`api.example.com`), an IPv4 address (`192.0.2.1`), or a `*.`-prefixed wildcard (`*.example.com`). URLs, ports, paths, and IPv6 addresses are not accepted. At most 16 entries.237238 - `secret_value: optional string or null`239240 Updated secret value.241242 minLength: 1, maxLength: 4096243244- `display_name: optional string or null`245246 Updated human-readable name for the credential. 1-255 characters.247248 minLength: 1, maxLength: 255249250- `metadata: optional map[string] or null`251252 Metadata patch. Set a key to a string to upsert it, or to null to delete it. Omitted keys are preserved.253254## Returns255256- `BetaManagedAgentsCredential object`257258 A credential stored in a vault. Sensitive fields are never returned in responses.259260 - `type: "vault_credential"`261262 - `id: string`263264 Unique identifier for the credential.265266 - `archived_at: string or null`267268 A timestamp in RFC 3339 format269270 format: date-time271272 - `auth: BetaManagedAgentsMCPOAuthAuthResponse or BetaManagedAgentsStaticBearerAuthResponse or BetaManagedAgentsEnvironmentVariableAuthResponse`273274 Authentication details for a credential.275276 - `BetaManagedAgentsMCPOAuthAuthResponse object`277278 OAuth credential details for an MCP server.279280 - `type: "mcp_oauth"`281282 - `mcp_server_url: string`283284 URL of the MCP server this credential authenticates against.285286 - `expires_at: optional string or null`287288 A timestamp in RFC 3339 format289290 format: date-time291292 - `refresh: optional BetaManagedAgentsMCPOAuthRefreshResponse or null`293294 OAuth refresh token configuration returned in credential responses.295296 - `client_id: string`297298 OAuth client ID.299300 - `token_endpoint: string`301302 Token endpoint URL used to refresh the access token.303304 - `token_endpoint_auth: BetaManagedAgentsTokenEndpointAuthNoneResponse or BetaManagedAgentsTokenEndpointAuthBasicResponse or BetaManagedAgentsTokenEndpointAuthPostResponse`305306 - `BetaManagedAgentsTokenEndpointAuthNoneResponse object`307308 Token endpoint requires no client authentication.309310 - `type: "none"`311312 - `BetaManagedAgentsTokenEndpointAuthBasicResponse object`313314 Token endpoint uses HTTP Basic authentication with client credentials.315316 - `type: "client_secret_basic"`317318 - `BetaManagedAgentsTokenEndpointAuthPostResponse object`319320 Token endpoint uses POST body authentication with client credentials.321322 - `type: "client_secret_post"`323324 - `resource: optional string or null`325326 OAuth resource indicator.327328 - `scope: optional string or null`329330 OAuth scope for the refresh request.331332 - `BetaManagedAgentsStaticBearerAuthResponse object`333334 Static bearer token credential details for an MCP server.335336 - `type: "static_bearer"`337338 - `mcp_server_url: string`339340 URL of the MCP server this credential authenticates against.341342 - `BetaManagedAgentsEnvironmentVariableAuthResponse object`343344 Environment variable credential details. The secret value is never returned.345346 - `type: "environment_variable"`347348 - `injection_location: BetaManagedAgentsInjectionLocationResponse`349350 Where in the outbound request the secret value is substituted.351352 - `body: boolean`353354 Whether the placeholder is substituted in the request body.355356 - `header: boolean`357358 Whether the placeholder is substituted in request header values.359360 - `networking: BetaManagedAgentsUnrestrictedCredentialNetworkingResponse or BetaManagedAgentsLimitedCredentialNetworkingResponse`361362 Outbound hosts the secret value is substituted on.363364 - `BetaManagedAgentsUnrestrictedCredentialNetworkingResponse object`365366 The secret is substituted on any host the session's Environment network policy permits egress to.367368 - `type: "unrestricted"`369370 - `BetaManagedAgentsLimitedCredentialNetworkingResponse object`371372 The secret is substituted only on requests to the listed hosts.373374 - `type: "limited"`375376 - `allowed_hosts: array of string`377378 Hostnames on which the secret will be substituted. An entry matches the request host exactly; a `*.`-prefixed entry matches any subdomain of the named domain but not the domain itself.379380 - `secret_name: string`381382 Name of the environment variable.383384 - `created_at: string`385386 A timestamp in RFC 3339 format387388 format: date-time389390 - `metadata: map[string]`391392 Arbitrary key-value metadata attached to the credential.393394 - `updated_at: string`395396 A timestamp in RFC 3339 format397398 format: date-time399400 - `vault_id: string`401402 Identifier of the vault this credential belongs to.403404 - `display_name: optional string or null`405406 Human-readable name for the credential.407408## Example409410```bash411curl https://api.anthropic.com/v1/vaults/$VAULT_ID/credentials/$CREDENTIAL_ID \412 -H 'Content-Type: application/json' \413 -H 'anthropic-version: 2023-06-01' \414 -H 'anthropic-beta: managed-agents-2026-04-01' \415 -H "X-Api-Key: $ANTHROPIC_API_KEY" \416 -d '{417 "display_name": "Example credential",418 "metadata": {419 "environment": "production"420 }421 }'422```423424### Response (200)425426```json427{428 "id": "vcrd_011CZkZEMt8gZan2iYOQfSkw",429 "archived_at": null,430 "auth": {431 "mcp_server_url": "https://example-server.modelcontextprotocol.io/sse",432 "type": "static_bearer"433 },434 "created_at": "2026-03-15T10:00:00Z",435 "metadata": {436 "environment": "production"437 },438 "type": "vault_credential",439 "updated_at": "2026-03-15T10:00:00Z",440 "vault_id": "vlt_011CZkZDLs7fYzm1hXNPeRjv",441 "display_name": "Example credential"442}443```444