Enable, disable, cap or label one member of a platform key pool
PATCH /v1/platform/credentials/{provider}/{key_id}
| Property | Value |
|---|---|
| Operation | update_platform_credential |
| Group | Platform |
| Scope | platform:write |
| Route class | control |
| Idempotency | No Idempotency-Key |
| Audit | Audited platform.credential.update (mutation) |
| Released in | 1.28.0 |
| Phase 0 host | Served (the hosted api pins 1.65.0) |
Applies the named fields to the active member at the revision If-Match names (1.28.0, workspace ADR 0075). A disabled member serves no new Session and a lower cap admits no Session above it, while running Sessions keep their member; the next admission reads the change. A revoked member, or one of another Provider, is not_found. The Audit event records the fields before and after, never the secret or the hint.
Request
Set VOCAL_API to the base URL of your API and VOCAL_API_KEY to an API key with the platform:write scope (Authentication and keys). Replace each placeholder, such as agt_... or <name>, with your own value.
curl -X PATCH "$VOCAL_API/v1/platform/credentials/mock/plk_..." \
-H "Authorization: Bearer $VOCAL_API_KEY" \
-H 'If-Match: "1"' \
-H "Content-Type: application/json" \
-d '{}'const response = await fetch(`${process.env.VOCAL_API}/v1/platform/credentials/mock/plk_...`, {
method: 'PATCH',
headers: {
Authorization: `Bearer ${process.env.VOCAL_API_KEY}`,
'If-Match': '"1"',
'Content-Type': 'application/json',
},
body: JSON.stringify({}),
});
console.log(response.status, await response.text());import os
import requests
response = requests.patch(
f"{os.environ['VOCAL_API']}/v1/platform/credentials/mock/plk_...",
headers={
"Authorization": f"Bearer {os.environ['VOCAL_API_KEY']}",
"If-Match": '"1"',
},
json={},
)
print(response.status_code, response.text)Parameters
| Name | In | Type | Required | Description |
|---|---|---|---|---|
provider | path | ProviderId | yes | A Provider: a vendor or in-process model behind a stage. The provider catalog says which stages each serves and whether it is available. From 1.38.0 openai is deprecated (workspace ADR 0085): its descriptors read deprecated, a deprecated Provider still resolves, and the id is kept until a major release; deepseek is new. From 1.53.0 amazon_titan serves embeddings, reserved until its adapter is built. |
key_id | path | PlatformCredentialId | yes | The id of a platform credential, one member of a Provider key pool: plk_ and the row's UUIDv7 in 26 Crockford base32 characters. Opaque and safe to log. |
if-match | header | string | yes | The revision the change was made against, quoted as the ETag returns it, or * to overwrite. |
Request body
Content type application/json, required: PlatformCredentialUpdateRequest.
| Field | Type | Required | Description |
|---|---|---|---|
enabled | boolean | no | False stops admission choosing the member; running Sessions keep it. |
label | string or null | no | The new operator note; null removes it. |
max_concurrent_sessions | MaxConcurrentSessions or null | no | The new cap; null removes it. A lower cap ends no running Session. |
Responses
| Status | Content type | Shape | Error codes |
|---|---|---|---|
200 | application/json | PlatformCredential | |
400 | application/json | ErrorEnvelope | invalid_request |
401 | application/json | ErrorEnvelope | unauthenticated |
403 | application/json | ErrorEnvelope | forbidden |
404 | application/json | ErrorEnvelope | not_found |
412 | application/json | ErrorEnvelope | revision_mismatch |
422 | application/json | ErrorEnvelope | validation_failed |
428 | application/json | ErrorEnvelope | precondition_required |
429 | application/json | ErrorEnvelope | rate_limited |
500 | application/json | ErrorEnvelope | internal_error |
Fields of the 200 answer
The shape is PlatformCredential.
| Field | Type | Required | Description |
|---|---|---|---|
account | VendorAccountUsage | no | The last reading the api took of the vendor account behind the member (1.40.0): its status, the units used and allowed and the plan's tier. Absent when the api has taken none, when the vendor has no account request, or from an api older than 1.40.0. A member whose key authenticates can still read exhausted. |
active_sessions | integer | no | The Sessions whose unreleased reservations name the member as the first entry of a stage, across Organizations, when the api answered (1.28.0); a count only. The api from 1.28.0 always sends it. |
created_at | Timestamp | yes | |
created_by | ActorRef | yes | |
enabled | boolean | no | Whether admission may choose the member (1.28.0); a disabled member keeps its secret, serves no new Session and leaves running Sessions on it. The api from 1.28.0 always sends it, and a reader treats its absence as true. |
hint | string | yes | The last four characters of the secret, to tell keys apart; never more. |
id | PlatformCredentialId | no | The member's id (1.28.0), the key id the Session configuration and the trace name. The api from 1.28.0 always sends it. |
label | string or null | yes | An operator note, or null. |
max_concurrent_sessions | MaxConcurrentSessions or null | no | The member's cap on concurrent Sessions (1.28.0), or null for no cap. The api from 1.28.0 always sends it, and a reader treats its absence as null. |
object | "platform_credential" | yes | |
provider | ProviderId | yes | |
revision | integer | no | Counts the member's changes from 1 (1.28.0); PATCH takes it in If-Match. The api from 1.28.0 always sends it. |
revoked_at | Timestamp or null | yes | Null while the version is active. |
status | PlatformCredentialStatus | yes | |
version | integer | yes | Counts the Provider's credential entries from 1. |