Skip to main content
PATCH
Patch Credential

Authorizations

Authorization
string
header
required

Bearer authentication header of the form Bearer <token>, where <token> is your auth token.

Path Parameters

team_id
string<uuid>
required
credential_id
string<uuid>
required

Body

application/json

Partial update to a team's stored IntegrationCredential.

Wire format

All fields are optional. Omitted fields keep their stored value. The shape mirrors RFC 7396 (JSON Merge Patch) at the extra_data level with two AITasker-specific tweaks:

  • Sensitive fields preserved on blank. If a sensitive field (github_token for Keystatic, app_password / application_password for WordPress) is sent as an empty string or null, the stored ENCRYPTED value is kept (post- migration e8b3encsec01 the secret lives in access_token_encrypted, not extra_data). This pairs with the masked-placeholder UX on the edit form: stored secrets render as placeholder="••••" and only submit when the user retypes them. Non-blank sensitive values are AES-256-GCM encrypted and written to the encrypted column; they NEVER land in extra_data.
  • Top-level shallow merge. Nested structures (e.g. Keystatic's content_paths dict) are REPLACED wholesale when the patch contains them. Edit-form convention: post the full nested dict for any structured field touched.

See team_integration_service.merge_credential_extra_data for the merge rules + encryption side-channel and unit tests.

Auth

PATCH requires team ownership — same gate as POST /config. A credential_id that doesn't belong to the caller's team returns 404, not 403, to prevent enumeration of other teams' credential ids.

extra_data
Extra Data · object | null
status
enum<string> | null
Available options:
pending,
credentials_saved,
connected,
needs_page_selection,
expired,
revoked,
error

Response

Successful Response

provider
string
required
status
string
required
account_name
string
required