> For clean Markdown of any page, append .md to the page URL.
> For a complete documentation index, see https://platform.bctrl.ai/llms.txt.
> For AI client integration (Claude Code, Cursor, etc.), connect to the MCP server at https://platform.bctrl.ai/_mcp/server.

# Update secret

> Update Vault secret fields without reading its value.

Update one or more fields on a Vault secret without reading its current value.
Fields not included remain unchanged. Use `null` to clear nullable fields.

## Update a secret

```ts
const updated = await bctrl.tools.call("vault.secrets.update", {
  name: "production/github/login",
  password: process.env.NEW_GITHUB_PASSWORD!,
  label: "Updated GitHub account",
});

console.log(updated.name, updated.hasTotp);
```

At least one field besides `name` must be provided.

## Request parameters

| Parameter        | Type               | Required | Description                                        |
| ---------------- | ------------------ | -------- | -------------------------------------------------- |
| `name`           | `VaultSecretName`  | Yes      | Secret to update.                                  |
| `username`       | `string`           | No       | Username on a login secret.                        |
| `password`       | `string`           | No       | Password on a login secret.                        |
| `value`          | `string`           | No       | Value on a value secret.                           |
| `totpSecret`     | `string \| null`   | No       | Base32 TOTP seed. Use `null` to clear it.          |
| `label`          | `string \| null`   | No       | Display label. Use `null` to clear it.             |
| `origins`        | `string[] \| null` | No       | Exact allowed origins. Use `null` to clear them.   |
| `originPatterns` | `string[] \| null` | No       | Allowed origin patterns. Use `null` to clear them. |
| `notes`          | `string \| null`   | No       | Private notes. Use `null` to clear them.           |

## Response

The response contains the same safe metadata as
[Get secret metadata](/sdk/tools/vault/vault-secrets-get); it never returns
the updated secret value.

| Field            | Type                 | Always present | Description                               |
| ---------------- | -------------------- | -------------- | ----------------------------------------- |
| `name`           | `VaultSecretName`    | Yes            | Secret name.                              |
| `type`           | `"login" \| "value"` | Yes            | Stored secret shape.                      |
| `label`          | `string`             | No             | Display label, when set.                  |
| `origins`        | `string[]`           | No             | Exact allowed origins, when configured.   |
| `originPatterns` | `string[]`           | No             | Allowed origin patterns, when configured. |
| `hasTotp`        | `boolean`            | Yes            | Whether a TOTP seed exists.               |
| `createdAt`      | `string`             | No             | Creation timestamp, when available.       |
| `updatedAt`      | `string`             | No             | Update timestamp, when available.         |

## Next

* [Get secret metadata](/sdk/tools/vault/vault-secrets-get) — inspect the result
* [Read secret value](/sdk/tools/vault/vault-secrets-value) — read when authorized
* [Spaces](/sdk/spaces) — configure Vault access