> ## Documentation Index > Fetch the complete documentation index at: https://docs.sync.cdata.com/llms.txt > Use this file to discover all available pages before exploring further. # Update a vault > Updates an external provider or the Standard and Encrypted environment variable patterns for the built-in System provider. The type, scope, and provider_key are immutable. The Local provider cannot be updated. Requires a Sync admin. ## OpenAPI ````yaml /26.4/en/rest-api/openapi-v2.json put /v2/vaults/{vault_id} openapi: 3.0.3 info: title: CData Sync API description: >- REST API (v2) for CData Sync. The API lets you manage workspaces, connections, jobs, transformations, pipelines, and users, and to run and monitor data replication and transformation work. ## Base path All endpoints are served under the `/api.rsc` application path, e.g. `https://your-sync-host/api.rsc/v2/workspaces`. ## Authentication Requests are authenticated with an auth token passed in the `x-cdata-authtoken` header, or with HTTP Basic authentication using a Sync user's credentials. A token can be generated via `POST /v2/users/generate-token`. ## Response envelope Successful read/write responses return a JSON **array** of objects, even when a single resource is requested (the array then contains one element). `count` endpoints return an array containing a single `{ "count": }` object. `DELETE` operations return `204 No Content`. ## Date/time format Date/time values are formatted as `yyyy-MM-dd'T'HH:mm:ssZZZ` (ISO-8601 with timezone offset). The format is also echoed in the `X-DateTime-Format` response header. ## Roles Most endpoints require the `cdata_user` role; workspace and user management endpoints require the `cdata_admin` role. version: '2.0' servers: - url: '{baseUrl}' variables: baseUrl: default: https://sync.example.com/api.rsc/v2 description: >- Base URL of your Sync instance, including scheme and application path (e.g. https://sync.example.com/api.rsc/v2). security: - ApiKeyAuth: [] - BasicAuth: [] tags: - name: Workspaces description: Manage workspaces and their child resources. - name: Connections description: Manage connections and inspect connection metadata. - name: Jobs description: Manage replication jobs, their tasks, history, and execution. - name: Transformations description: Manage transformations, their tasks, history, and execution. - name: Pipelines description: Manage pipelines, steps, events, history, and execution. - name: Users description: Manage users and generate auth tokens. - name: Vaults description: Manage vault registrations and the secrets stored in the Local vault. - name: Search description: Search accessible resources across workspaces. paths: /v2/vaults/{vault_id}: parameters: - name: vault_id in: path required: true schema: type: string put: tags: - Vaults summary: Update a vault description: >- Updates an external provider or the Standard and Encrypted environment variable patterns for the built-in System provider. The type, scope, and provider_key are immutable. The Local provider cannot be updated. Requires a Sync admin. operationId: updateVault requestBody: required: true content: application/json: schema: $ref: '#/components/schemas/VaultUpdate' responses: '200': description: The updated vault. content: application/json: schema: $ref: '#/components/schemas/Vault' '400': $ref: '#/components/responses/BadRequest' '403': $ref: '#/components/responses/Forbidden' '404': $ref: '#/components/responses/NotFound' '409': $ref: '#/components/responses/Conflict' components: schemas: VaultUpdate: type: object properties: display_name: type: string config: type: object additionalProperties: true description: >- Provider configuration. For the built-in System vault, standardPatterns and encryptedPatterns update the comma-separated environment variable patterns. Both may be empty to disable environment variable imports. For the System vault, all other config fields are rejected. For external providers, sensitive fields (for example clientSecret) are encrypted at rest and returned masked (********) in responses. Vault: type: object additionalProperties: false properties: id: type: string provider_key: type: string description: Globally unique reference key. Immutable after create. display_name: type: string type: type: string description: Vault provider type. enum: - Local - System - AzureKeyVault scope: type: string description: Vault scope. Registrations use system scope. enum: - SYSTEM config: type: object additionalProperties: true description: >- Provider configuration. Non-sensitive fields are returned as stored; sensitive fields (for example clientSecret) are returned masked (********). Empty for the Local vault. For the built-in System vault, standardPatterns and encryptedPatterns contain comma-separated environment variable names or wildcard patterns. created_at: type: string format: date-time updated_at: type: string format: date-time Error: type: object additionalProperties: false properties: code: type: integer description: HTTP status code. message: type: string description: Short status message. error: type: string description: Detailed error description. error_code: type: string description: >- Stable Vault error category when the failure originated from a Vault operation. enum: - INVALID_REFERENCE - PROVIDER_NOT_FOUND - ITEM_NOT_FOUND - PROVIDER_UNAVAILABLE - AUTHENTICATION_FAILED - PERMISSION_DENIED - TYPE_MISMATCH - INVALID_REGISTRATION - READ_ONLY - UNKNOWN provider_id: type: string description: Vault provider identifier when safe and applicable. item_name: type: string description: Vault item name when safe and applicable. responses: BadRequest: description: The request was invalid. content: application/json: schema: $ref: '#/components/schemas/Error' Forbidden: description: The caller does not have permission to access this resource. content: application/json: schema: $ref: '#/components/schemas/Error' NotFound: description: The requested resource does not exist. content: application/json: schema: $ref: '#/components/schemas/Error' Conflict: description: >- The resource is in a state that conflicts with the request (e.g. already running). content: application/json: schema: $ref: '#/components/schemas/Error' securitySchemes: ApiKeyAuth: type: apiKey in: header name: x-cdata-authtoken description: A Sync user auth token. Generate one via POST /v2/users/generate-token. BasicAuth: type: http scheme: basic description: HTTP Basic authentication with a Sync user's username and API Token. ```` This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.