> ## Documentation Index
> Fetch the complete documentation index at: https://syteca.com/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# Update Secret

> Syteca ACB REST API endpoint to update a secret — change name, target, password, rotation, check-out, heartbeat, or permissions. Partial update — only the fields provided are changed.

Updates a secret. This is a **partial update** (PATCH semantics) — only fields included in the request body are changed; omitted fields are left unchanged.

<Note>
  For ACB deployments updated from a version prior to 1.2, switch to the `https://{hostname}/EkranACB` server in the Playground.
</Note>

### Permissions required

* **Editor** or **Owner** role on the secret for most field changes.
* **Owner** role required to modify the `permissions` field.

### Common update patterns

| Update                                          | Fields to include                                                              |
| ----------------------------------------------- | ------------------------------------------------------------------------------ |
| **Set a new password manually**                 | `password: { password: "..." }`                                                |
| **Change rotation schedule**                    | `rotation: { enabled, rotate_every_min }`                                      |
| **Enable scheduled heartbeat checks** *(v1.4+)* | `check_password: { enabled: true, check_every: 1, check_period_type: "Hour" }` |
| **Move to a different folder**                  | `parent_folder_id: <newId>`                                                    |
| **Replace permissions** *(Owner role required)* | `permissions: [ ... ]`                                                         |

<Note>
  **Changing `type` after creation is not supported.** Create a new secret of the desired type and delete the old one if you need to convert.
</Note>

### Errors

See [Status codes](/docs/api/acb/api-reference#status-codes). Common errors:

* **400 Bad Request** — invalid configuration object (e.g. `rotate_every_min: 0`, no longer accepted in v1.4 — use `enabled: false` instead).
* **403 Forbidden** — user lacks Editor/Owner, or lacks Owner when modifying permissions.
* **404 Not Found** — secret doesn't exist.

## Related

<CardGroup cols={2}>
  <Card title="Get secret" icon="info" href="/docs/api/acb/endpoints/get-secret">Read current secret state.</Card>
  <Card title="Add secret" icon="plus" href="/docs/api/acb/endpoints/add-secret">Field reference shared with PATCH.</Card>
  <Card title="Rotate password" icon="refresh-ccw" href="/docs/api/acb/endpoints/rotate-secret-password">Trigger rotation without manual value.</Card>
  <Card title="Data models" icon="braces" href="/docs/api/acb/data-models">Schemas for nested config objects.</Card>
</CardGroup>


## OpenAPI

````yaml PATCH /api/secrets/{id}
openapi: 3.0.3
info:
  title: Application Credentials Broker API
  description: >-
    API for managing secrets and folders in the Application Credentials Broker
    system
  version: 1.4.0
  contact:
    name: API Support
    email: support@example.com
servers:
  - url: https://your-syteca-host/SytecaACB
    description: On-premises Syteca ACB service (v1.2 or later)
    variables:
      hostname:
        default: your-syteca-host.example.com
        description: Your Syteca Application Server hostname
  - url: https://your-syteca-host/EkranACB
    description: Legacy URL prefix for ACB deployments updated from pre-v1.2
    variables:
      hostname:
        default: your-syteca-host.example.com
        description: Your Syteca Application Server hostname
security:
  - AccessTokenAuth: []
paths:
  /api/secrets/{id}:
    patch:
      tags:
        - Secrets
      summary: Update secret
      description: Updates an existing secret with the provided data
      operationId: updateSecret
      parameters:
        - name: id
          in: path
          required: true
          description: The ID of the secret to update
          schema:
            type: integer
            format: int32
            minimum: 1
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/SecretUpdateRequestDto'
      responses:
        '200':
          description: Secret updated successfully
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/SecretPasswordlessResponseDto'
        '400':
          description: Invalid request data
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
        '403':
          description: Access denied
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
        '404':
          description: Secret not found
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
components:
  schemas:
    SecretUpdateRequestDto:
      type: object
      properties:
        name:
          type: string
          maxLength: 512
          description: Name of the secret
        description:
          type: string
          maxLength: 2000
          description: Description of the secret
        password:
          type: string
          description: The password value
        ssh_key:
          $ref: '#/components/schemas/SshKey'
        parent_folder_id:
          type: integer
          format: int32
          minimum: 0
          description: ID of the parent folder
        parent_folder_name:
          type: string
          maxLength: 512
          description: Name of the parent folder
        domain:
          type: string
          maxLength: 512
          description: Domain for AD accounts
        computer_name:
          type: string
          maxLength: 512
          description: Computer name for Windows/Unix accounts
        url:
          type: string
          maxLength: 2000
          format: uri
          description: URL for web accounts
        server:
          type: string
          maxLength: 512
          description: Server for database accounts
        login:
          type: string
          maxLength: 512
          description: Login username
        computers:
          type: array
          items:
            type: string
          description: List of computers
        file_transfer:
          $ref: '#/components/schemas/FileTransfer'
        rotation:
          $ref: '#/components/schemas/Rotation'
        record_activities:
          type: boolean
          description: Whether to record activities for this secret
        check_out:
          $ref: '#/components/schemas/CheckOut'
        require_approval:
          $ref: '#/components/schemas/RequireApproval'
        permissions:
          $ref: '#/components/schemas/Permissions'
        check_password:
          $ref: '#/components/schemas/CheckPassword'
    SecretPasswordlessResponseDto:
      type: object
      properties:
        id:
          type: integer
          format: int32
          description: Unique identifier of the secret
        name:
          type: string
          description: Name of the secret
        type:
          $ref: '#/components/schemas/SecretType'
        description:
          type: string
          description: Description of the secret
        parent_folder_id:
          type: integer
          format: int32
          description: ID of the parent folder
        domain:
          type: string
          description: Domain for AD accounts
        computer_name:
          type: string
          description: Computer name for Windows/Unix accounts
        url:
          type: string
          description: URL for web accounts
        server:
          type: string
          description: Server for database accounts
        login:
          type: string
          description: Login username
        computers:
          type: array
          items:
            type: string
          description: List of computers
        file_transfer:
          $ref: '#/components/schemas/FileTransfer'
        rotation:
          $ref: '#/components/schemas/Rotation'
        record_activities:
          type: boolean
          description: Whether to record activities for this secret
        check_out:
          $ref: '#/components/schemas/CheckOut'
        require_approval:
          $ref: '#/components/schemas/RequireApproval'
        permissions:
          $ref: '#/components/schemas/Permissions'
        check_password:
          $ref: '#/components/schemas/CheckPassword'
        check_password_status:
          $ref: '#/components/schemas/PasswordCheckStatus'
        last_password_check_utc:
          type: string
          format: date-time
          nullable: true
          description: UTC timestamp of the last password check
        password_rotation_status:
          $ref: '#/components/schemas/PasswordRotationStatus'
        last_password_rotation_utc:
          type: string
          format: date-time
          nullable: true
          description: UTC timestamp of the last password rotation
      required:
        - id
        - name
        - type
        - login
    ErrorResponse:
      type: object
      properties:
        status:
          type: integer
          description: HTTP status code
        message:
          type: string
          description: Error message
      required:
        - status
        - message
    SshKey:
      type: object
      properties:
        private_key:
          type: string
          description: SSH private key
        pass_phrase:
          type: string
          description: Passphrase for the private key
      required:
        - private_key
    FileTransfer:
      type: object
      properties:
        protocol:
          $ref: '#/components/schemas/FileTransferProtocol'
        port:
          type: integer
          format: int32
          minimum: 0
          maximum: 65535
          default: 22
          description: Port number for file transfer
      required:
        - protocol
        - port
    Rotation:
      type: object
      properties:
        enabled:
          type: boolean
          description: Whether rotation is enabled
        rotate_every_min:
          type: integer
          format: int32
          minimum: 1
          description: Rotation interval in minutes
      required:
        - enabled
        - rotate_every_min
    CheckOut:
      type: object
      properties:
        enabled:
          type: boolean
          description: Whether check-out is enabled
        rotate_on_checkin:
          type: boolean
          description: Whether to rotate password on check-in
        auto_checkin_after_min:
          type: integer
          format: int32
          default: 60
          description: Auto check-in timeout in minutes
      required:
        - enabled
        - rotate_on_checkin
        - auto_checkin_after_min
    RequireApproval:
      type: object
      properties:
        require_approval_type:
          $ref: '#/components/schemas/SecretUsagePermissionType'
        approver_users:
          type: array
          items:
            type: string
          description: List of approver users
        approver_user_groups:
          type: array
          items:
            type: string
          description: List of approver user groups
        require_owners_and_approvers:
          type: boolean
          default: false
          description: Whether to require both owners and approvers
        working_dates:
          $ref: '#/components/schemas/WorkingDatePeriod'
        working_hours:
          $ref: '#/components/schemas/WorkingTimePeriod'
        working_days:
          type: array
          items:
            $ref: '#/components/schemas/DayOfWeek'
          description: Working days of the week
      required:
        - require_approval_type
    Permissions:
      type: object
      properties:
        inherit_users_and_roles:
          type: boolean
          default: false
          description: Whether to inherit users and roles from parent
        inherit_features:
          type: boolean
          default: false
          description: Whether to inherit features from parent
        users:
          type: array
          items:
            $ref: '#/components/schemas/Permission'
          description: User permissions
        user_groups:
          type: array
          items:
            $ref: '#/components/schemas/Permission'
          description: User group permissions
    CheckPassword:
      type: object
      properties:
        enabled:
          type: boolean
          default: false
          description: Whether heartbeat password checking is enabled
        check_every:
          type: integer
          format: int32
          default: 30
          description: Interval for password check.
        check_period_type:
          $ref: '#/components/schemas/PasswordCheckPeriodType'
      required:
        - enabled
        - check_every
        - check_period_type
    SecretType:
      type: string
      enum:
        - None
        - UnixAccountSSH
        - UnixAccountTelnet
        - WindowsAccount
        - ADAccount
        - WebAccount
        - MSSQLAccount
      description: Type of secret
    PasswordCheckStatus:
      type: string
      enum:
        - None
        - Valid
        - Invalid
        - Failed
      description: Status of the last password check (heartbeat)
    PasswordRotationStatus:
      type: string
      enum:
        - Disabled
        - Enabled
        - Failed
      description: Status of password rotation
    FileTransferProtocol:
      type: string
      enum:
        - Sftp
        - Scp
        - Ftp
      description: File transfer protocol
    SecretUsagePermissionType:
      type: string
      enum:
        - None
        - RequiredForAll
        - RequiredForOwners
        - RequiredForNonOwners
      description: Secret usage permission type
    WorkingDatePeriod:
      type: object
      properties:
        from:
          type: string
          format: date-time
          description: Start date
        to:
          type: string
          format: date-time
          description: End date
      required:
        - from
        - to
    WorkingTimePeriod:
      type: object
      properties:
        from:
          type: string
          format: time
          description: Start time
        to:
          type: string
          format: time
          description: End time
      required:
        - from
        - to
    DayOfWeek:
      type: string
      enum:
        - Sunday
        - Monday
        - Tuesday
        - Wednesday
        - Thursday
        - Friday
        - Saturday
      description: Day of the week
    Permission:
      type: object
      properties:
        name:
          type: string
          description: User or group name
        access_type:
          $ref: '#/components/schemas/SecretPermissionType'
        features:
          type: array
          items:
            $ref: '#/components/schemas/AdditionalFeature'
          description: Additional features granted
      required:
        - name
        - access_type
    PasswordCheckPeriodType:
      type: string
      enum:
        - Minute
        - Hour
        - Day
      description: Period type for the password check interval
    SecretPermissionType:
      type: string
      enum:
        - None
        - PAMUser
        - Owner
        - Viewer
      description: Secret permission type
    AdditionalFeature:
      type: string
      enum:
        - CopyPassword
        - ViewPassword
        - FileTransfer
      description: Additional features for permissions
  securitySchemes:
    AccessTokenAuth:
      type: apiKey
      in: header
      name: Authorization
      description: Access token for authentication

````