# Change a Server Credential

Its name, role, allow-list or expiry. The key never changes: a new key is a new credential.

## Overview

- Only the fields sent change; each follows the rules of [Register a Credential](https://docs.aureahub.com/docs/server-credential-create.md), with the same refusals. A new role keeps the credential's `roleNarrows`. `"expiresAt": null` removes the expiry; `"allowedIps": []` allows any address. A change applies to the credential's next token.
- Nothing to change answers `400` `SERVER_CREDENTIAL_NOTHING_TO_CHANGE` (`Nothing to change: send name, role, allowedIps or expiresAt (a credential's key never changes: register a new credential instead)`).
- `403` `SERVER_CREDENTIAL_ROLE_ABOVE_OWN` when the new role, or the credential's current one, holds a permission yours does not.
- `404` `SERVER_CREDENTIAL_NOT_FOUND` (`Server credential not found`) for a credential that is not this tenant's. `409` `SERVER_CREDENTIAL_REVOKED` (`This server credential is revoked`), or `SERVER_CREDENTIAL_EXPIRED` (`This server credential has expired: register a new one`).
- Same roles as Register a Credential.

> Note: **Your tenant's quorum** [Coming soon, upon request](https://docs.aureahub.com/docs/feature-availability.md) — where it holds administrators' actions (a tenant on the institutional security profile by its profile; every other tenant's records them only): this call answers `202` `{ "state": "awaiting_quorum", "requestId" }` — the **202** tab below — and nothing is done until another administrator of your tenant approves it; the answer it would have given is then read once by who asked ([Read the Answer](https://docs.aureahub.com/docs/quorum-request-result.md)). With no other administrator able to approve it, it is done at once. [Your Tenant's Quorum](https://docs.aureahub.com/docs/guide-tenant-quorum.md). Every other tenant gets the answers below, unchanged.

## Endpoint

### `PATCH /v1/admin/tenants/{id}/server-credentials/{credentialId}`

Authentication: bearer token required.

Changes a server credential's name, role, allow-list or expiry.

**Path parameters**

| Name | Type | Required | Description |
| --- | --- | --- | --- |
| `id` | string | yes | Tenant UUID |
| `credentialId` | string | yes | The credential's id |

**Request body**

| Name | Type | Required | Description |
| --- | --- | --- | --- |
| `name` | string | no | 1–100 characters |
| `role` | string | no | A tenant role within yours |
| `allowedIps` | string[] | no | Replaces the allow-list; empty: any address |
| `expiresAt` | string (date-time) \| null | no | A new expiry; `null`: none |

**Responses**

`200` Changed

```json
{
  "id": "2f6d8a4e-1c3b-4e5f-9a7d-0b2c4e6f8a1c",
  "tenantId": "6f1e2d3c-4b5a-4968-8776-a5b4c3d2e1f0",
  "name": "Payments server",
  "role": "signer",
  "status": "active",
  "publicKey": {
    "kty": "EC",
    "crv": "P-256",
    "x": "kTxt6XgA4C3r8RE3iDiksXglx-XqsKZBKcJXz8xb9Bg",
    "y": "2UOzdwbCN0bU_vBmtae1dx458v3t1PXqowMQIp9qahU"
  },
  "thumbprint": "eh1D5t_soPjcyGjYMXEeNtyTxia1As4QO91SxspJPfM",
  "allowedIps": ["203.0.113.0/24", "2001:db8::/32"],
  "expiresAt": null,
  "createdAt": "2026-10-06T08:40:12.307Z",
  "createdBy": "5d2c1b0a-9e8f-4a7b-8c6d-5e4f3a2b1c0d",
  "updatedAt": "2026-10-06T11:20:48.015Z",
  "updatedBy": "5d2c1b0a-9e8f-4a7b-8c6d-5e4f3a2b1c0d",
  "lastUsedAt": "2026-10-06T11:19:03.442Z",
  "revokedAt": null,
  "revokedBy": null,
  "revokeReason": null,
  "roleNarrows": true
}
```

`202` Awaiting quorum

```json
{
  "state": "awaiting_quorum",
  "requestId": "4e2b9c17-8a3d-4f60-b5e1-7c9d0a2f6b38"
}
```

`409` Revoked

```json
{
  "statusCode": 409,
  "error": "ConflictError",
  "message": "This server credential is revoked",
  "details": { "code": "SERVER_CREDENTIAL_REVOKED" }
}
```

---

Web version: https://docs.aureahub.com/#server-credential-update