> ## Documentation Index > Fetch the complete documentation index at: https://docs.deck.co/llms.txt > Use this file to discover all available pages before exploring further. # Update a credential > Updates a credential's authentication details or external ID. Only the fields you include in the request body are updated. ## OpenAPI ````yaml /api-reference/v2.json patch /credentials/{credential_id} openapi: 3.1.1 info: title: Deck API version: 2.0.0 servers: - url: https://api.deck.co/v2 description: Production security: - BearerAuth: [] tags: - name: Agents description: >- Agents are the AI workers that execute tasks against sources. Create and manage the agents in your organization. - name: Components description: >- Embeddable UI components. Create short-lived session tokens for the Auth Component. - name: Platform description: Organization-wide platform settings, such as the static IP range. - name: Credentials description: >- Credentials store the login details an agent uses at a source. Values are tokenized at rest and never returned in plaintext. - name: Event Destinations description: >- Where Deck delivers events: webhooks, SQS, Kinesis, S3, and more. Manage destinations and inspect delivery attempts. - name: Events description: >- Immutable records of things that happened in your organization, such as a task run completing or a credential being verified. - name: Sessions description: >- Sessions are agent sandbox lifetimes. A session is created for each task run (or explicitly) and counts toward your concurrency limit. - name: Sources description: >- Sources are the websites and portals agents work against. Register, inspect, reset, and delete them. - name: Storage description: >- Files produced by task runs: downloaded documents, exports, and extraction results. - name: Task Runs description: >- A task run is one execution of a task. Inspect status and output, retrieve files and screenshots, cancel runs, and answer interaction requests. - name: Tasks description: >- Tasks define reusable units of work for an agent: a goal, an input schema, and an output schema. Run them against sources with credentials. - name: Test description: Connectivity check for your API key. - name: Triggers description: Triggers run tasks automatically on a schedule or in response to events. - name: Workflows - name: Workflow Runs paths: /credentials/{credential_id}: patch: tags: - Credentials summary: Update a credential description: >- Updates a credential's authentication details or external ID. Only the fields you include in the request body are updated. operationId: updateCredential parameters: - name: credential_id in: path required: true schema: type: string pattern: ^cred_ example: cred_AbC123xYz456 description: Unique identifier for the credential (prefixed with `cred_`). - name: Idempotency-Key in: header required: false description: >- Optional key that makes the request idempotent. Retrying with the same key returns the original response instead of repeating the operation; keys expire after 24 hours. Any string up to 256 characters. See [Idempotency](/api/idempotency). schema: type: string maxLength: 256 example: 550e8400-e29b-41d4-a716-446655440000 requestBody: content: application/json: schema: $ref: '#/components/schemas/UpdateCredentialRequest' text/json: schema: $ref: '#/components/schemas/UpdateCredentialRequest' application/*+json: schema: $ref: '#/components/schemas/UpdateCredentialRequest' required: true responses: '200': description: OK content: text/plain: schema: $ref: '#/components/schemas/UpdateCredentialResponse' application/json: schema: $ref: '#/components/schemas/UpdateCredentialResponse' text/json: schema: $ref: '#/components/schemas/UpdateCredentialResponse' '400': description: Bad request — validation error or malformed input. content: application/json: schema: $ref: '#/components/schemas/ValidationErrorResponse' '401': description: Unauthorized. '403': description: Forbidden. '404': description: Not found — the requested resource does not exist. content: application/json: schema: $ref: '#/components/schemas/ErrorResponse' '409': description: >- Conflict — the request is valid but cannot be completed in the current state. Also returned when an `Idempotency-Key` is reused with different request parameters (`idempotency_error`). content: application/json: schema: $ref: '#/components/schemas/ErrorResponse' '422': description: >- Unprocessable content — the request body is understood but contains invalid values. content: application/json: schema: $ref: '#/components/schemas/ErrorResponse' '429': description: >- Too many requests — the organization-wide API rate limit was exceeded (`rate_limit_exceeded`). Retry with exponential backoff. content: application/json: schema: $ref: '#/components/schemas/ErrorResponse' '500': description: Internal server error. content: application/json: schema: $ref: '#/components/schemas/ErrorResponse' components: schemas: UpdateCredentialRequest: type: object properties: auth_credentials: $ref: '#/components/schemas/AuthCredentialsInput' external_id: type: - 'null' - string description: Updated external identifier. Set to `null` to remove the mapping. persistence: $ref: '#/components/schemas/PersistenceInput' description: >- Updated persistence settings. Setting `enabled` to `false` permanently deletes the saved login state. description: >- Request body for updating a credential. Only include fields you want to change. UpdateCredentialResponse: required: - id - object - status - source_id - auth_method - auth_credentials - persistence - external_id - created_at - updated_at - request_id type: object properties: id: type: string description: Unique identifier for the credential, prefixed with `cred_`. pattern: ^cred_ example: cred_AbC123xYz456 object: type: string description: Always `credential`. status: type: string description: >- Credential status: `unverified`, `verified`, `invalid`, or `deleted`. source_id: type: string description: >- The source this credential authenticates against. Prefixed with `src_`. auth_method: type: string description: >- Authentication method: `username_password`, `source_fields`, `google_sso`, `apple_sso`, or `none`. auth_credentials: oneOf: - type: 'null' - $ref: '#/components/schemas/AuthCredentialsSummary' description: Summary of stored credentials. Sensitive values are not returned. persistence: $ref: '#/components/schemas/PersistenceSummary' description: Persistence settings for this credential. external_id: type: - 'null' - string description: External identifier from your system, if set. created_at: type: string format: date-time description: ISO 8601 timestamp of when the resource was created. example: '2026-08-24T12:00:00Z' updated_at: type: string format: date-time description: ISO 8601 timestamp of when the resource was last updated. example: '2026-08-24T12:00:00Z' request_id: type: string description: >- Unique identifier for the API request. Include this when contacting support. ValidationErrorResponse: required: - errors type: object properties: type: type: - 'null' - string description: RFC 9110 problem type URI. title: type: - 'null' - string description: Short summary of the validation failure. status: type: - 'null' - integer description: HTTP status code. format: int32 errors: type: object additionalProperties: type: array items: type: string description: Validation errors grouped by field name. traceId: type: - 'null' - string description: Request trace identifier. description: Validation error returned for malformed requests (HTTP 400). ErrorResponse: required: - errors - request_id type: object properties: errors: type: array items: $ref: '#/components/schemas/TaskRunError' description: One or more errors that describe what went wrong. request_id: type: string description: Unique identifier for this request, useful for tracing. description: Standard error response. AuthCredentialsInput: type: object properties: username: type: string description: Username for `username_password`. email: type: string description: >- The end user's Google or Apple Account email, for `google_sso` and `apple_sso`. Must be a valid email address. password: type: string description: >- Password for `username_password`, or the Google or Apple Account password for `google_sso` and `apple_sso`. Encrypted at rest and never returned. source_fields: type: object additionalProperties: type: string description: >- Additional values the source requires at login, beyond what the `auth_method` covers (for example, `{ "company_id": "ACME-4412" }`). For the `source_fields` auth method, at least one entry is required. Values must be strings. Keys must match `^[a-z][a-z0-9_]{0,63}$`, must not collide with reserved keys on the `auth_method` (such as `username`, `email` or `password`), and are capped at 10 entries per credential. Values are returned in the clear on read unless named in `tokenized`. tokenized: type: array items: type: string description: >- Names of `source_fields` keys to vault. Each entry must name a key present in `source_fields`. Tokenized values are stored in a secure vault, removed from API responses, and listed by name in the response `tokenized` array; they cannot be read back. On update, may only name keys supplied in the same request. Auth secrets such as `password` are always vaulted regardless of this array. description: >- Credentials payload. Structure depends on `auth_method`. For `username_password`, pass `username` and `password`. For `google_sso` and `apple_sso`, pass `email` and `password` for the end user's Google or Apple Account. For `source_fields`, pass at least one entry in `source_fields`. Any `auth_method` except `none` may also include `source_fields` alongside its credentials (for example, `username` and `password` plus `source_fields` in the same payload), and `tokenized` to vault selected source-field values. PersistenceInput: type: object properties: enabled: type: boolean description: >- Whether to save this credential's login state between runs. Defaults to `false`. description: >- Credential persistence settings. When enabled, Deck saves the credential's authenticated login state after each run and restores it on later runs. Sources that honor the restored state skip the login flow and repeat MFA prompts. AuthCredentialsSummary: type: object properties: username: type: - 'null' - string description: The username associated with this credential, if applicable. email: type: - 'null' - string description: The Google or Apple Account email, for `google_sso` and `apple_sso`. source_fields: type: object additionalProperties: type: string description: >- Non-tokenized `source_fields` returned as key/value pairs in the clear (for example, `{ "company_id": "ACME-4412" }`). Tokenized source fields are dropped from this map and named in `tokenized` instead. Omitted when empty. tokenized: type: array items: type: string description: >- Names of the source fields whose values were vaulted. Their values never appear in `source_fields` and cannot be read back through the API. Omitted when nothing was tokenized. description: >- Summary of stored authentication credentials. Secret values such as `password` are encrypted at rest and never returned. Non-tokenized `source_fields` are returned in the clear; fields named in `tokenized` are vaulted and omitted from the map. PersistenceSummary: required: - enabled type: object properties: enabled: type: boolean description: Whether persistence is enabled for this credential. description: Persistence settings for this credential. TaskRunError: required: - type - code - message type: object properties: type: type: string description: >- Error category (e.g. `source`, `auth`, `task`, `rate_limit`). Determines the class of failure. code: type: string description: Machine-readable error code. Use this for programmatic handling. message: type: string description: >- Human-readable explanation. Do not rely on this for logic — it may change. field: type: - 'null' - string description: The input field that caused the error, when applicable. description: Error details for a failed task run. Same structure as API-level errors. securitySchemes: BearerAuth: type: http description: Secret key (sk_live_...) scheme: bearer bearerFormat: JWT ```` This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.