Replaces a credential's name, type, principal, and/or secret. Renaming or re-pointing the principal doesn't require a new secret -- leave Secret blank and the stored one is left alone, since there's no way to show you the current secret first for comparison (it's write-only, see Create a Credential).

Having trouble reaching the API, or logging in from another machine? See Network Access & Authentication Security -- by default the Api only answers localhost, and PowerShell needs an extra flag once it does answer elsewhere.

Order of Operations

1. Authenticate to the API.
2. Get the credential's id (from List Credentials).
3. Send the updated fields.

The call

PUT /api/credentials/{credentialId}

Permission needed: Credential.Manage.

C# example

var jsonOptions = new JsonSerializerOptions(JsonSerializerDefaults.Web);

// Step 1: Authenticate to the API.
using var handler = new HttpClientHandler { UseDefaultCredentials = true };
using var client = new HttpClient(handler) { BaseAddress = new Uri("http://your-minion-agent-server:5443") };
client.DefaultRequestHeaders.Add("X-App-Name", "MyIntegration");

// Step 2: You already have the credential's id (from List Credentials).
var credentialId = 12;

// Step 3: Send the updated fields -- Secret left null keeps the stored one unchanged.
var update = new UpdateCredentialRequest(
    CredentialName: "SQLPROD02 Service Account (renamed)",
    CredentialType: "WindowsUser",
    Principal: "CORP\\svc-minionagent2",
    Secret: null,
    IsElevated: false);
var response = await client.PutAsJsonAsync($"/api/credentials/{credentialId}", update, jsonOptions);
response.EnsureSuccessStatusCode();
Console.WriteLine("Updated.");

record UpdateCredentialRequest(string CredentialName, string CredentialType, string Principal, string? Secret, bool IsElevated,
    string? TenantId = null, string? SubscriptionId = null);

Not on a domain machine? Swap in the app-account login from Calling the API From Your Own Code.

PowerShell example

# Step 1: Authenticate to the API.
$headers = @{ "X-App-Name" = "MyIntegration" }

# Step 2: You already have the credential's id (from List Credentials).
$credentialId = 12

# Step 3: Send the updated fields -- omitting Secret (or sending an empty string) keeps the stored one unchanged. (-AllowUnencryptedAuthentication: PowerShell requires this for Windows auth over plain http to anything but localhost -- see "Network Access & Authentication Security".)
$update = @{
    CredentialName = "SQLPROD02 Service Account (renamed)"
    CredentialType = "WindowsUser"
    Principal      = "CORP\svc-minionagent2"
    Secret         = $null
    IsElevated     = $false
} | ConvertTo-Json
Invoke-RestMethod -Uri "http://your-minion-agent-server:5443/api/credentials/$credentialId" `
    -Method Put -Body $update -ContentType "application/json" -UseDefaultCredentials -AllowUnencryptedAuthentication -Headers $headers

"Updated."

What you get back

204 No Content -- no body.

Codes this call can return

See API Response Codes for what each one means in general. For this specific call:

• 204 -- updated.
• 400 -- CredentialType isn't one of the recognized values.
• 403 -- you don't have Credential.Manage.
• 404 -- no credential exists with that id.

What gets audited

Recorded as Credential / Alter Credential, with CredentialName, CredentialType, Principal, IsElevated, and a SecretChanged boolean in the after-state. The secret's value is never audited either way -- only whether it changed.

Only the IsElevated flag by itself? Use Set a Credential's Elevated Flag instead -- it's a narrower, single-purpose call.

See also: List Credentials, Create a Credential, Set a Credential's Elevated Flag.