> ## Documentation Index > Fetch the complete documentation index at: https://infisical.com/docs/llms.txt > Use this file to discover all available pages before exploring further. # Update service > Update a service in an Agent Vault access bundle ## OpenAPI ````yaml PATCH /api/v1/agent-vault/access-bundles/{accessBundleId}/services/{serviceId} openapi: 3.0.3 info: title: Infisical API description: List of all available APIs that can be consumed version: 0.0.1 servers: - url: https://us.infisical.com description: Production server (US) - url: https://eu.infisical.com description: Production server (EU) - url: http://localhost:8080 description: Local server security: [] paths: /api/v1/agent-vault/access-bundles/{accessBundleId}/services/{serviceId}: patch: tags: - Agent Vault Access Bundles description: Update a service in an Agent Vault access bundle operationId: updateAgentVaultService parameters: - schema: type: string format: uuid in: path name: accessBundleId required: true description: The ID of the access bundle. - schema: type: string format: uuid in: path name: serviceId required: true description: The ID of the service. requestBody: required: true content: application/json: schema: anyOf: - type: object properties: type: type: string enum: - http description: >- The service's type, `http` or `mcp`. Must match the type the service was created with. name: type: string minLength: 1 maxLength: 64 description: The name of the service. hostPattern: type: string maxLength: 1024 description: >- A comma-separated set of hosts this service covers, each optionally with a port (defaults to `443`). A leading `*.` wildcard matches exactly one label. Paths are not supported. allowedMethods: type: array items: type: string enum: - GET - HEAD - POST - PUT - PATCH - DELETE - OPTIONS minItems: 1 maxItems: 7 nullable: true description: >- The HTTP methods this service allows. Null allows every method. Anything else is refused by the proxy with a 403. allowedPathPrefixes: type: array items: type: string minItems: 1 maxItems: 20 nullable: true description: >- The path prefixes this service allows, matched on whole segments, so `/repos` covers `/repos/octo` but not `/repositories`. `null` allows every path. A path-restricted service also refuses any request whose path would have to be normalised to judge. credential: anyOf: - type: object properties: type: type: string enum: - bearer headerName: type: string minLength: 1 maxLength: 128 pattern: ^[A-Za-z0-9!#$%&'*+.^_`|~-]+$ description: >- The header the credential is written to. Defaults to `Authorization`. headerPrefix: type: string maxLength: 64 pattern: ^[^\x00-\x1f\x7f]*$ description: >- Written before the credential value, separated by one space. Leave empty for a header that carries the value alone, such as DD-API-KEY. Can't contain `{{` or `}}`. On update a field left out keeps its stored value, so send an empty string to clear the prefix when changing the header. value: type: string minLength: 1 maxLength: 8192 pattern: ^[^\x00-\x1f\x7f]*$ description: >- The secret. Can use up to 3 references to Agent Vault's variables, written as `{{KEY}}`. A reference that repeats counts each time. Omit to keep the stored secret. memberProvidedFields: type: array items: type: string enum: - credential-value maxItems: 1 description: >- Leave the token to each member: send `credential-value` here and no `value`. Every member sets their own, and a session uses the token of the member who started it. A session a machine identity started on behalf of a user uses that user's token instead. Omit on update to keep the current setting; send an empty list to set the token yourself again, which then needs a `value`. Changing this clears every member's saved values for the service. required: - type additionalProperties: false title: Bearer - type: object properties: type: type: string enum: - basic username: type: string maxLength: 256 pattern: ^[^\x00-\x1f\x7f]*$ description: >- The username half of the basic credential. Can use up to 3 references to Agent Vault's variables, written as `{{KEY}}`. A reference that repeats counts each time. Omit to keep the stored username; send an empty string to remove it, which requires a password. password: type: string maxLength: 8192 pattern: ^[^\x00-\x1f\x7f]*$ description: >- The password half of the basic credential. Can use up to 3 references to Agent Vault's variables, written as `{{KEY}}`. A reference that repeats counts each time. Omit to keep the stored password; send an empty string to remove it, which requires a username. memberProvidedFields: type: array items: type: string enum: - credential-value - credential-username maxItems: 2 description: >- The halves of the basic credential each member sets for themselves: `credential-username`, `credential-value` (the password) or both. Send no value for a half listed here. A session uses the values of the member who started it. A session a machine identity started on behalf of a user uses that user's values instead. Omit on update to keep the current setting. Adding a half keeps what members saved, and taking one back deletes only that half's values. Changing the credential type deletes every member's values for the service. required: - type additionalProperties: false title: Basic Auth - type: object properties: type: type: string enum: - passthrough required: - type additionalProperties: false title: Pass-through customHeaders: type: array items: type: object properties: id: type: string format: uuid description: >- The ID of the custom header. Send it to change that header in place. Omit it to match by name. name: type: string minLength: 1 maxLength: 128 pattern: ^[A-Za-z0-9!#$%&'*+.^_`|~-]+$ description: >- The name of the header, which must not be the credential's own header. prefix: type: string maxLength: 64 pattern: ^[^\x00-\x1f\x7f]*$ description: >- Written before the header value, separated by one space. Can't contain `{{` or `}}`. Unlike the value, an omitted prefix is cleared rather than kept, since the stored prefix is returned and can be resent. value: type: string minLength: 1 maxLength: 8192 pattern: ^[^\x00-\x1f\x7f]*$ description: >- The header value. Can use up to 3 references to Agent Vault's variables, written as `{{KEY}}`. A reference that repeats counts each time. Omit to keep the value already stored for this header. required: - name additionalProperties: false maxItems: 20 description: >- Additional headers the proxy attaches to every request to this service, on top of the credential. Send the full list. A header you leave out is deleted. Send a header's `id` to change it in place and keep its stored value. Without an `id`, a header is matched by name. substitutions: type: array items: type: object properties: id: type: string format: uuid description: >- The ID of the substitution. Send it to change that substitution in place. Omit it to match by placeholder. placeholder: type: string minLength: 1 maxLength: 255 pattern: ^[^\x00-\x1f\x7f]*$ description: >- The fake value your agent already sends. The proxy replaces it with the real secret. Matched as a plain string, so a distinctive placeholder is worth choosing. Can't contain `{{` or `}}`. surfaces: type: array items: type: string enum: - path - query - header - body minItems: 1 maxItems: 4 description: >- Where in the request to look for the placeholder: path, query, header or body. value: type: string minLength: 1 maxLength: 8192 pattern: ^[^\x00-\x1f\x7f]*$ description: >- The real value the placeholder is replaced with. Can use up to 3 references to Agent Vault's variables, written as `{{KEY}}`. A reference that repeats counts each time. Omit to keep the value already stored. required: - placeholder - surfaces additionalProperties: false maxItems: 20 description: >- Placeholders the proxy swaps for a real secret before forwarding. Send the full list. A substitution you leave out is deleted. Send a substitution's `id` to change it in place and keep its stored value. Without an `id`, it is matched by its placeholder. required: - type additionalProperties: false title: HTTP service - type: object properties: type: type: string enum: - mcp description: >- The service's type, `http` or `mcp`. Must match the type the service was created with. name: type: string minLength: 1 maxLength: 64 description: The name of the service. serverUrl: type: string minLength: 1 maxLength: 2048 description: >- The MCP server's URL, such as `https://mcp.example.com/mcp`. Must use `https`, with no username, password, query string or fragment. transport: type: string enum: - streamable-http - sse description: >- How the agent talks to the MCP server: `streamable-http`, or `sse` for the legacy HTTP+SSE transport. credential: anyOf: - type: object properties: type: type: string enum: - bearer headerName: type: string minLength: 1 maxLength: 128 pattern: ^[A-Za-z0-9!#$%&'*+.^_`|~-]+$ description: >- The header the credential is written to. Defaults to `Authorization`. headerPrefix: type: string maxLength: 64 pattern: ^[^\x00-\x1f\x7f]*$ description: >- Written before the credential value, separated by one space. Leave empty for a header that carries the value alone, such as DD-API-KEY. Can't contain `{{` or `}}`. On update a field left out keeps its stored value, so send an empty string to clear the prefix when changing the header. value: type: string minLength: 1 maxLength: 8192 pattern: ^[^\x00-\x1f\x7f]*$ description: >- The secret. Can use up to 3 references to Agent Vault's variables, written as `{{KEY}}`. A reference that repeats counts each time. Omit to keep the stored secret. memberProvidedFields: type: array items: type: string enum: - credential-value maxItems: 1 description: >- Leave the token to each member: send `credential-value` here and no `value`. Every member sets their own, and a session uses the token of the member who started it. A session a machine identity started on behalf of a user uses that user's token instead. Omit on update to keep the current setting; send an empty list to set the token yourself again, which then needs a `value`. Changing this clears every member's saved values for the service. required: - type additionalProperties: false title: Bearer description: >- The credential the proxy attaches to requests to the MCP server, a bearer token. To use OAuth instead, connect the service in the Infisical UI. allowedTools: type: array items: type: string minItems: 1 maxItems: 500 nullable: true description: >- The MCP tools agents can call through this service, by exact, case-sensitive name. Each name is 1 to 128 letters, numbers, underscores (_), hyphens (-), or dots (.). `null` allows every tool. The proxy refuses a call to any other tool and leaves it out of the server's tool list. MCP services only. customHeaders: type: array items: type: object properties: id: type: string format: uuid description: >- The ID of the custom header. Send it to change that header in place. Omit it to match by name. name: type: string minLength: 1 maxLength: 128 pattern: ^[A-Za-z0-9!#$%&'*+.^_`|~-]+$ description: >- The name of the header, which must not be the credential's own header. prefix: type: string maxLength: 64 pattern: ^[^\x00-\x1f\x7f]*$ description: >- Written before the header value, separated by one space. Can't contain `{{` or `}}`. Unlike the value, an omitted prefix is cleared rather than kept, since the stored prefix is returned and can be resent. value: type: string minLength: 1 maxLength: 8192 pattern: ^[^\x00-\x1f\x7f]*$ description: >- The header value. Can use up to 3 references to Agent Vault's variables, written as `{{KEY}}`. A reference that repeats counts each time. Omit to keep the value already stored for this header. required: - name additionalProperties: false maxItems: 20 description: >- Additional headers the proxy attaches to every request to this service, on top of the credential. Send the full list. A header you leave out is deleted. Send a header's `id` to change it in place and keep its stored value. Without an `id`, a header is matched by name. required: - type additionalProperties: false title: MCP service responses: '200': description: Default Response content: application/json: schema: type: object properties: service: type: object properties: id: type: string format: uuid description: The ID of the service. accessBundleId: type: string format: uuid description: The ID of the access bundle. name: type: string description: The name of the service. type: type: string enum: - http - mcp description: >- The service type: `http` for an HTTP API, or `mcp` for a remote MCP server. Can't be changed after the service is created. serverUrl: type: string nullable: true description: The MCP server's full URL. Null for an `http` service. transport: type: string enum: - streamable-http - sse nullable: true description: >- How the agent talks to the MCP server: `streamable-http`, or `sse` for the legacy HTTP+SSE transport. Null for an `http` service. hostPattern: type: string description: >- A comma-separated set of hosts this service covers, each optionally with a port (defaults to `443`). A leading `*.` wildcard matches exactly one label. Paths are not supported. allowedMethods: type: array items: type: string enum: - GET - HEAD - POST - PUT - PATCH - DELETE - OPTIONS nullable: true description: >- The HTTP methods this service allows. Null allows every method. Anything else is refused by the proxy with a 403. allowedPathPrefixes: type: array items: type: string nullable: true description: >- The path prefixes this service allows, matched on whole segments, so `/repos` covers `/repos/octo` but not `/repositories`. `null` allows every path. A path-restricted service also refuses any request whose path would have to be normalised to judge. allowedTools: type: array items: type: string nullable: true description: >- The MCP tools agents can call through this service, by exact, case-sensitive name. Each name is 1 to 128 letters, numbers, underscores (_), hyphens (-), or dots (.). `null` allows every tool. The proxy refuses a call to any other tool and leaves it out of the server's tool list. MCP services only. credential: anyOf: - type: object properties: type: type: string enum: - bearer headerName: type: string description: >- The header the credential is written to. Defaults to `Authorization`. headerPrefix: type: string description: >- Written before the credential value, separated by one space. Leave empty for a header that carries the value alone, such as DD-API-KEY. Can't contain `{{` or `}}`. On update a field left out keeps its stored value, so send an empty string to clear the prefix when changing the header. memberProvidedFields: type: array items: type: string enum: - credential-value description: >- The credential fields each member sets for themselves: credential-value (a bearer token, a basic password, or an OAuth sign-in) and credential-username. Empty when the admin sets the whole credential. required: - type - headerName - headerPrefix - memberProvidedFields additionalProperties: false title: Bearer - type: object properties: type: type: string enum: - basic memberProvidedFields: type: array items: type: string enum: - credential-value - credential-username description: >- The credential fields each member sets for themselves: credential-value (a bearer token, a basic password, or an OAuth sign-in) and credential-username. Empty when the admin sets the whole credential. required: - type - memberProvidedFields additionalProperties: false title: Basic Auth - type: object properties: type: type: string enum: - passthrough required: - type additionalProperties: false title: Pass-through - type: object properties: type: type: string enum: - oauth memberProvidedFields: type: array items: type: string enum: - credential-value description: >- The credential fields each member sets for themselves: credential-value (a bearer token, a basic password, or an OAuth sign-in) and credential-username. Empty when the admin sets the whole credential. status: type: string enum: - connected - needs-reauthorization - needs-additional-scopes description: >- Whether the OAuth connection works: `connected`, `needs-reauthorization` (the tokens can no longer be refreshed), or `needs-additional-scopes` (the MCP server asked for scopes the connection lacks). Absent when each member signs in for themselves. issuer: type: string description: >- The OAuth authorization server that issued the tokens. registration: type: string enum: - dynamic - manual description: >- With the sign-in left to members: `manual` when every member signs in with your own OAuth app, `dynamic` when each sign-in registers its own client. clientId: type: string nullable: true description: >- With the sign-in left to members and your own OAuth app: its client ID. grantedScopes: type: array items: type: string description: The scopes the authorization server granted. requiredScopes: type: array items: type: string description: >- Scopes the MCP server asked for that the connection lacks. Reauthorize to request them. expiresAt: type: string nullable: true description: >- When the current access token expires, or null if the server didn't say. Not returned to Agent Vault members. authorizedAt: type: string nullable: true description: >- When the connection was last authorized. Not returned to Agent Vault members. lastError: type: string nullable: true description: >- The last refresh failure, if any. Never contains a token. Not returned to Agent Vault members. required: - type - memberProvidedFields - issuer - grantedScopes - requiredScopes additionalProperties: false title: OAuth customHeaders: type: array items: type: object properties: id: type: string format: uuid description: >- The ID of the custom header. Send it to change that header in place. Omit it to match by name. name: type: string description: >- The name of the header, which must not be the credential's own header. prefix: type: string description: >- Written before the header value, separated by one space. Leave empty to send the value alone. Can't contain `{{` or `}}`. required: - id - name - prefix additionalProperties: false description: >- Additional headers the proxy attaches to every request to this service, on top of the credential. Send the full list. A header you leave out is deleted. Send a header's `id` to change it in place and keep its stored value. Without an `id`, a header is matched by name. substitutions: type: array items: type: object properties: id: type: string format: uuid description: >- The ID of the substitution. Send it to change that substitution in place. Omit it to match by placeholder. placeholder: type: string description: >- The fake value your agent already sends. The proxy replaces it with the real secret. Matched as a plain string, so a distinctive placeholder is worth choosing. Can't contain `{{` or `}}`. surfaces: type: array items: type: string enum: - path - query - header - body description: >- Where in the request to look for the placeholder: path, query, header or body. required: - id - placeholder - surfaces additionalProperties: false description: >- Placeholders the proxy swaps for a real secret before forwarding. Send the full list. A substitution you leave out is deleted. Send a substitution's `id` to change it in place and keep its stored value. Without an `id`, it is matched by its placeholder. variableReferences: type: array items: anyOf: - type: object properties: variableId: type: string format: uuid description: The ID of the variable. key: type: string description: >- The name values use to refer to the variable, as `{{KEY}}`. Starts with a letter and uses only upper case letters, numbers and underscores. field: type: string enum: - credential-value - credential-username description: >- Which value uses the variable: credential-value (a bearer token or a basic password), credential-username, custom-header or substitution. required: - variableId - key - field additionalProperties: false title: Credential - type: object properties: variableId: type: string format: uuid description: The ID of the variable. key: type: string description: >- The name values use to refer to the variable, as `{{KEY}}`. Starts with a letter and uses only upper case letters, numbers and underscores. field: type: string enum: - custom-header description: >- Which value uses the variable: credential-value (a bearer token or a basic password), credential-username, custom-header or substitution. customHeaderId: type: string format: uuid description: >- The custom header whose value uses the variable. required: - variableId - key - field - customHeaderId additionalProperties: false title: Custom Header - type: object properties: variableId: type: string format: uuid description: The ID of the variable. key: type: string description: >- The name values use to refer to the variable, as `{{KEY}}`. Starts with a letter and uses only upper case letters, numbers and underscores. field: type: string enum: - substitution description: >- Which value uses the variable: credential-value (a bearer token or a basic password), credential-username, custom-header or substitution. substitutionId: type: string format: uuid description: >- The substitution whose value uses the variable. required: - variableId - key - field - substitutionId additionalProperties: false title: Substitution description: >- The global variables this service's credential, custom header values and substitution values use. Not returned to Agent Vault members, since only admins can see global variables. A member's own personal variables are listed under personalValues. createdAt: type: string format: date-time description: When the service was added to the access bundle. updatedAt: type: string format: date-time description: When the service was last changed. required: - id - accessBundleId - name - type - serverUrl - transport - hostPattern - allowedMethods - allowedPathPrefixes - allowedTools - credential - customHeaders - substitutions - variableReferences - createdAt - updatedAt additionalProperties: false required: - service additionalProperties: false '400': description: Default Response content: application/json: schema: type: object properties: reqId: type: string statusCode: type: number enum: - 400 message: type: string error: type: string details: {} required: - reqId - statusCode - message - error additionalProperties: false '401': description: Default Response content: application/json: schema: type: object properties: reqId: type: string statusCode: type: number enum: - 401 message: type: string error: type: string required: - reqId - statusCode - message - error additionalProperties: false '403': description: Default Response content: application/json: schema: type: object properties: reqId: type: string statusCode: type: number enum: - 403 message: type: string details: {} error: type: string required: - reqId - statusCode - message - error additionalProperties: false '404': description: Default Response content: application/json: schema: type: object properties: reqId: type: string statusCode: type: number enum: - 404 message: type: string error: type: string required: - reqId - statusCode - message - error additionalProperties: false '422': description: Default Response content: application/json: schema: type: object properties: reqId: type: string statusCode: type: number enum: - 422 message: {} error: type: string required: - reqId - statusCode - error additionalProperties: false '500': description: Default Response content: application/json: schema: type: object properties: reqId: type: string statusCode: type: number enum: - 500 message: type: string error: type: string required: - reqId - statusCode - message - error additionalProperties: false ```` This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.