Update a provider configuration

Update the supplied fields; omitted fields remain unchanged. Names must remain unique within the organization. Requires an organization-scoped credential or dashboard authentication; project-scoped credentials receive 403.

PATCH /vault-provider-configs/{id_or_name}

cURL

agentcard

curl --request PATCH \
  --url https://api.onkernel.com/vault-provider-configs/{id_or_name} \
  --header 'Authorization: Bearer <token>' \
  --header 'Content-Type: application/json' \
  --data '
{
  "credentials": {
    "client_secret": "example-rotated-client-secret"
  }
}
'

200

agentcard

{
  "client_id": "example-client-id",
  "created_at": "2026-01-01T12:00:00Z",
  "id": "vpc_agentcard_example",
  "name": "my-agentcard",
  "provider": "agentcard",
  "test_mode": false,
  "updated_at": "2026-01-02T12:00:00Z"
}

Authorizations

Authorization · string · header · required

Bearer authentication header of the form Bearer <token>, where <token> is your auth token.

Path Parameters

id_or_name · string · required

Provider configuration ID or name in the organization.

Body

application/json

Update a provider configuration. Omitted fields are left unchanged. Renaming preserves wallet bindings. Credential updates apply to all wallets using this configuration. Provider and client ID are immutable; changing clients requires a new configuration. The selected configuration determines how credentials are validated; its identity and mode must not change during secret rotation.

credentials · object · write-only

Fields to update. Omitted credentials are left unchanged. A rejected update leaves existing credentials unchanged.

Show child attributes

name · string

Unique within the organization.

Pattern: ^[a-zA-Z0-9._-]{1,255}$

Response

200

application/json

Provider configuration updated without returning secrets

Option 1

Option 2

Response schema for a Link configuration, without secret credentials. Kernel generates the ID and timestamps. Configuration creation uses VaultLinkProviderConfigRequest.

client_id · string · required

OAuth client identity; immutable. Secret credentials are never returned.

created_at · string<date-time> · required · read-only

id · string · required · read-only

name · string · required

Unique within the organization.

Pattern: ^[a-zA-Z0-9._-]{1,255}$

provider · enum<string> · required

Available options: link

updated_at · string<date-time> · required · read-only