VocalDocscontracts 1.65.0

Enable, disable, cap or label one member of a platform key pool

PATCH /v1/platform/credentials/{provider}/{key_id}

PropertyValue
Operationupdate_platform_credential
GroupPlatform
Scopeplatform:write
Route classcontrol
IdempotencyNo Idempotency-Key
AuditAudited platform.credential.update (mutation)
Released in1.28.0
Phase 0 hostServed (the hosted api pins 1.65.0)

Applies the named fields to the active member at the revision If-Match names (1.28.0, workspace ADR 0075). A disabled member serves no new Session and a lower cap admits no Session above it, while running Sessions keep their member; the next admission reads the change. A revoked member, or one of another Provider, is not_found. The Audit event records the fields before and after, never the secret or the hint.

Request

Set VOCAL_API to the base URL of your API and VOCAL_API_KEY to an API key with the platform:write scope (Authentication and keys). Replace each placeholder, such as agt_... or <name>, with your own value.

curl -X PATCH "$VOCAL_API/v1/platform/credentials/mock/plk_..." \
  -H "Authorization: Bearer $VOCAL_API_KEY" \
  -H 'If-Match: "1"' \
  -H "Content-Type: application/json" \
  -d '{}'

Parameters

NameInTypeRequiredDescription
providerpathProviderIdyesA Provider: a vendor or in-process model behind a stage. The provider catalog says which stages each serves and whether it is available. From 1.38.0 openai is deprecated (workspace ADR 0085): its descriptors read deprecated, a deprecated Provider still resolves, and the id is kept until a major release; deepseek is new. From 1.53.0 amazon_titan serves embeddings, reserved until its adapter is built.
key_idpathPlatformCredentialIdyesThe id of a platform credential, one member of a Provider key pool: plk_ and the row's UUIDv7 in 26 Crockford base32 characters. Opaque and safe to log.
if-matchheaderstringyesThe revision the change was made against, quoted as the ETag returns it, or * to overwrite.

Request body

Content type application/json, required: PlatformCredentialUpdateRequest.

FieldTypeRequiredDescription
enabledbooleannoFalse stops admission choosing the member; running Sessions keep it.
labelstring or nullnoThe new operator note; null removes it.
max_concurrent_sessionsMaxConcurrentSessions or nullnoThe new cap; null removes it. A lower cap ends no running Session.

Responses

StatusContent typeShapeError codes
200application/jsonPlatformCredential
400application/jsonErrorEnvelopeinvalid_request
401application/jsonErrorEnvelopeunauthenticated
403application/jsonErrorEnvelopeforbidden
404application/jsonErrorEnvelopenot_found
412application/jsonErrorEnveloperevision_mismatch
422application/jsonErrorEnvelopevalidation_failed
428application/jsonErrorEnvelopeprecondition_required
429application/jsonErrorEnveloperate_limited
500application/jsonErrorEnvelopeinternal_error

Fields of the 200 answer

The shape is PlatformCredential.

FieldTypeRequiredDescription
accountVendorAccountUsagenoThe last reading the api took of the vendor account behind the member (1.40.0): its status, the units used and allowed and the plan's tier. Absent when the api has taken none, when the vendor has no account request, or from an api older than 1.40.0. A member whose key authenticates can still read exhausted.
active_sessionsintegernoThe Sessions whose unreleased reservations name the member as the first entry of a stage, across Organizations, when the api answered (1.28.0); a count only. The api from 1.28.0 always sends it.
created_atTimestampyes
created_byActorRefyes
enabledbooleannoWhether admission may choose the member (1.28.0); a disabled member keeps its secret, serves no new Session and leaves running Sessions on it. The api from 1.28.0 always sends it, and a reader treats its absence as true.
hintstringyesThe last four characters of the secret, to tell keys apart; never more.
idPlatformCredentialIdnoThe member's id (1.28.0), the key id the Session configuration and the trace name. The api from 1.28.0 always sends it.
labelstring or nullyesAn operator note, or null.
max_concurrent_sessionsMaxConcurrentSessions or nullnoThe member's cap on concurrent Sessions (1.28.0), or null for no cap. The api from 1.28.0 always sends it, and a reader treats its absence as null.
object"platform_credential"yes
providerProviderIdyes
revisionintegernoCounts the member's changes from 1 (1.28.0); PATCH takes it in If-Match. The api from 1.28.0 always sends it.
revoked_atTimestamp or nullyesNull while the version is active.
statusPlatformCredentialStatusyes
versionintegeryesCounts the Provider's credential entries from 1.