> ## Documentation Index > Fetch the complete documentation index at: https://docs.getdialed.ai/llms.txt > Use this file to discover all available pages before exploring further. # Update a credential > Update a credential's name, status and authentication configuration. Admin only. Supply `credentials` to ROTATE the stored secret. The new material replaces the old in place: the credential keeps its id and keeps pointing at the same stored secret, so every flow that uses this credential picks the new material up with no flow edit, no re-selection and no redeployment. Running workers refresh their cached copy within five minutes. Rotating an OAuth2 credential also clears its cached access token, so the next run fetches a fresh token with the new material. Tokens the provider has already issued are not revoked here and remain valid until they expire on the provider's own schedule. Rotation keeps the credential's provider-account binding, so the new material must belong to the same provider account and identity as the old. When the platform can identify the account credentials belong to, the new material is verified against it during the rotation: material that resolves to a different account or identity is refused with a 409 — create a separate credential for it instead. Rotating clears the credential's last verification time, because the recorded check described the previous material. Run a test to record a fresh one. `platform_id` must match the stored value — a credential belongs to one platform for its whole life. Server-managed fields (the provider account binding, the stored-secret pointer, the observed-use record) cannot be set from a request body and are preserved. Cross-tenant access returns 404. ## OpenAPI ````yaml /openapi.json put /credentials/{credential_id} openapi: 3.1.0 info: title: GetDialed API version: 0.1.0 servers: - url: https://api.getdialed.ai/v1 description: Production security: [] paths: /credentials/{credential_id}: put: tags: - credentials summary: Update a credential description: >- Update a credential's name, status and authentication configuration. Admin only. Supply `credentials` to ROTATE the stored secret. The new material replaces the old in place: the credential keeps its id and keeps pointing at the same stored secret, so every flow that uses this credential picks the new material up with no flow edit, no re-selection and no redeployment. Running workers refresh their cached copy within five minutes. Rotating an OAuth2 credential also clears its cached access token, so the next run fetches a fresh token with the new material. Tokens the provider has already issued are not revoked here and remain valid until they expire on the provider's own schedule. Rotation keeps the credential's provider-account binding, so the new material must belong to the same provider account and identity as the old. When the platform can identify the account credentials belong to, the new material is verified against it during the rotation: material that resolves to a different account or identity is refused with a 409 — create a separate credential for it instead. Rotating clears the credential's last verification time, because the recorded check described the previous material. Run a test to record a fresh one. `platform_id` must match the stored value — a credential belongs to one platform for its whole life. Server-managed fields (the provider account binding, the stored-secret pointer, the observed-use record) cannot be set from a request body and are preserved. Cross-tenant access returns 404. operationId: update_credential_credentials__credential_id__put parameters: - name: credential_id in: path required: true schema: type: string title: Credential Id requestBody: required: true content: application/json: schema: $ref: '#/components/schemas/CredentialUpdate' responses: '200': description: Successful Response content: application/json: schema: $ref: '#/components/schemas/CredentialResponse' '400': description: >- The update tries to move the credential to a different platform, which would orphan its provider-account binding content: application/json: example: detail: >- platform_id cannot be changed on an existing credential. The stored provider account, the credential's identity and the shape of the stored secret all belong to one platform. Create a credential for the other platform instead. '401': description: Missing or invalid authentication content: application/json: example: detail: Authentication required '403': description: Caller is authenticated but not an admin content: application/json: example: detail: Admin role required '404': description: >- No such credential for this organization (cross-tenant access also returns 404) content: application/json: example: detail: Credential not found '409': description: >- The rotation's new material resolves to a different provider identity or tenant than the stored binding describes, so the rotation is refused rather than silently rebound content: application/json: example: detail: >- The new material belongs to a different provider account or identity than this credential is bound to. Create a separate credential for it instead of rotating this one. '422': description: Validation Error content: application/json: schema: $ref: '#/components/schemas/HTTPValidationError' '429': description: Rate limit exceeded — retry after the Retry-After header headers: Retry-After: description: Seconds to wait before retrying schema: type: integer content: application/json: example: detail: 'Rate limit exceeded: 100 per 1 minute' security: - APIKeyHeader: [] - HTTPBearer: [] components: schemas: CredentialUpdate: properties: name: type: string title: Name platform_id: type: string title: Platform Id auth_method: type: string enum: - basic_auth - api_key - jwt - oauth2 - aws_access_key title: Auth Method credentials: anyOf: - additionalProperties: true type: object - type: 'null' title: Credentials credentials_ref: anyOf: - type: string - type: 'null' title: Credentials Ref grant_type: anyOf: - type: string - type: 'null' title: Grant Type token_url: anyOf: - type: string - type: 'null' title: Token Url scopes: items: type: string type: array title: Scopes audience: anyOf: - type: string - type: 'null' title: Audience api_key_placement: anyOf: - $ref: '#/components/schemas/ApiKeyPlacement' - type: 'null' aws_region: anyOf: - type: string - type: 'null' title: Aws Region aws_default_bucket: anyOf: - type: string - type: 'null' title: Aws Default Bucket aws_endpoint_url: anyOf: - type: string - type: 'null' title: Aws Endpoint Url status: type: string enum: - active - expired - revoked title: Status default: active type: object required: - name - platform_id - auth_method title: CredentialUpdate example: auth_method: basic_auth credentials: password: REPLACE_ME username: api_user@example name: Five9 Production platform_id: five9 status: active CredentialResponse: properties: id: type: string title: Id org_id: type: string title: Org Id name: type: string title: Name platform_id: type: string title: Platform Id auth_method: type: string title: Auth Method credentials_ref: type: string title: Credentials Ref tenancy_id: anyOf: - type: string - type: 'null' title: Tenancy Id tenant: anyOf: - $ref: '#/components/schemas/CredentialTenantSummary' - type: 'null' grant_type: anyOf: - type: string - type: 'null' title: Grant Type token_url: anyOf: - type: string - type: 'null' title: Token Url scopes: items: type: string type: array title: Scopes audience: anyOf: - type: string - type: 'null' title: Audience api_key_placement: anyOf: - $ref: '#/components/schemas/ApiKeyPlacement' - type: 'null' aws_region: anyOf: - type: string - type: 'null' title: Aws Region aws_default_bucket: anyOf: - type: string - type: 'null' title: Aws Default Bucket aws_endpoint_url: anyOf: - type: string - type: 'null' title: Aws Endpoint Url telemetry: additionalProperties: $ref: '#/components/schemas/CredentialTelemetrySummary' type: object title: Telemetry status: type: string title: Status created_by: type: string title: Created By last_verified: anyOf: - type: string format: date-time - type: 'null' title: Last Verified created_at: anyOf: - type: string format: date-time - type: 'null' title: Created At type: object required: - id - org_id - name - platform_id - auth_method - credentials_ref - status - created_by title: CredentialResponse example: auth_method: basic_auth created_at: '2026-08-01T12:00:00Z' created_by: user_11223344 credentials_ref: getdialed/acme/five9/cred_e5f6g7h8 id: cred_e5f6g7h8 last_verified: '2026-08-22T09:00:00Z' name: Five9 Production org_id: org_a1b2c3d4 platform_id: five9 scopes: [] status: active telemetry: five9__configuration_service: last_stamped_at: '2026-08-22T09:00:00Z' last_succeeded_at: '2026-08-22T09:00:00Z' last_used_at: '2026-08-22T09:00:00Z' tenancy_id: ten_1a2b3c4d5e6f7890 tenant: id: ten_1a2b3c4d5e6f7890 is_manual: false label: Acme VCC platform_id: five9 HTTPValidationError: properties: detail: items: $ref: '#/components/schemas/ValidationError' type: array title: Detail type: object title: HTTPValidationError ApiKeyPlacement: properties: header_name: anyOf: - type: string - type: 'null' title: Header Name scheme: anyOf: - type: string - type: 'null' title: Scheme query_param: anyOf: - type: string - type: 'null' title: Query Param type: object title: ApiKeyPlacement description: >- Where an API-key credential puts its key. This is presentation configuration, not secret material: it holds the header NAME (and optionally a scheme such as `Bearer` prefixed to the value), or the query-parameter NAME. A form renders straight from it. It is declared ONCE, on the credential, so every task that selects this credential injects the key identically and no task configuration ever mentions authentication. Exactly one of `header_name` or `query_param` is set; `scheme` is legal only alongside `header_name`. CredentialTenantSummary: properties: id: type: string title: Id label: type: string title: Label platform_id: type: string title: Platform Id is_manual: type: boolean title: Is Manual type: object required: - id - label - platform_id - is_manual title: CredentialTenantSummary description: >- The provider account or customer-named tenant this credential belongs to. example: id: ten_1a2b3c4d5e6f7890 is_manual: false label: Acme VCC platform_id: five9 CredentialTelemetrySummary: properties: last_used_at: anyOf: - type: string format: date-time - type: 'null' title: Last Used At last_succeeded_at: anyOf: - type: string format: date-time - type: 'null' title: Last Succeeded At last_failed_at: anyOf: - type: string format: date-time - type: 'null' title: Last Failed At last_error_class: anyOf: - type: string - type: 'null' title: Last Error Class last_stamped_at: anyOf: - type: string format: date-time - type: 'null' title: Last Stamped At type: object title: CredentialTelemetrySummary description: |- Observed use of one credential against one service. Read straight off the credential, so a client can show health without a second call. example: last_stamped_at: '2026-08-22T09:00:00Z' last_succeeded_at: '2026-08-22T09:00:00Z' last_used_at: '2026-08-22T09:00:00Z' ValidationError: properties: loc: items: anyOf: - type: string - type: integer type: array title: Location msg: type: string title: Message type: type: string title: Error Type input: title: Input ctx: type: object title: Context type: object required: - loc - msg - type title: ValidationError securitySchemes: APIKeyHeader: type: apiKey in: header name: X-API-Key HTTPBearer: type: http scheme: bearer bearerFormat: JWT ````