# Update

Launch stage: GA

`PATCH /api/2.1/unity-catalog/secrets/{full_name}`

Updates an existing secret in Unity Catalog.

 You must be the owner of the secret or a metastore admin. If you are a metastore
 admin, only the **owner** field can be changed.

 Use the **update_mask** field to specify which fields to update. Supported updatable fields
 include **value**, **comment**, **owner**, and **expire_time**.

API scopes: unity-catalog

## Path parameters

- `full_name` (string, optional)
  The three-level (fully qualified) name of the secret
   (for example, **catalog_name.schema_name.secret_name**).

## Query parameters

- `update_mask` (string, optional)
  The field mask specifying which fields of the secret to update.
   - If **update_mask** is **"*"**, all fields specified in **secret** are updated.
   - If **update_mask** specifies one or more fields, only those fields are updated.
     Each specified field must be set in **secret**.
   Supported fields: **value**, **comment**, **owner**, **expire_time**. To change the secret
   name, delete and recreate the secret.

## Request body

- `secret` (object, optional)
  The secret object containing the fields to update. Only fields specified in **update_mask**
   will be updated.
  - `name` (string, optional)
    The name of the secret, relative to its parent schema.
  - `owner` (string, optional)
    The owner of the secret. Defaults to the creating principal on creation. Can be updated to
     transfer ownership of the secret to another principal.
  - `effective_owner` (string, optional)
    The effective owner of the secret, which may differ from the directly-set **owner** due to
     inheritance.
  - `metastore_id` (string, optional)
    Unique identifier of the metastore hosting the secret.
  - `create_time` (string, optional)
    The time at which this secret was created.
  - `created_by` (string, optional)
    The principal that created the secret.
  - `update_time` (string, optional)
    The time at which this secret was last updated.
  - `updated_by` (string, optional)
    The principal that last updated the secret.
  - `comment` (string, optional)
    User-provided free-form text description of the secret.
    Constraints: `[ 1 .. 65536 ] characters`
  - `full_name` (string, optional)
    The three-level (fully qualified) name of the secret, in the form of **catalog_name.schema_name.secret_name**.
  - `catalog_name` (string, optional)
    The name of the catalog where the schema and the secret reside.
  - `schema_name` (string, optional)
    The name of the schema where the secret resides.
  - `value` (string, optional)
    The secret value to store. This field is input-only and is not returned in responses — use
     the **effective_value** field (via GetSecret with **include_value** set to true) to read the
     secret value. The maximum size is 60 KiB (pre-encryption). Accepted content includes
     passwords, tokens, keys, and other sensitive credential data.
    Constraints: `[ 1 .. 61440 ] characters`
  - `effective_value` (string, optional)
    The secret value. Only populated in responses when you have the **READ_SECRET**
     privilege and **include_value** is set to true in the request. The maximum size is 60 KiB.
    Constraints: `[ 1 .. 61440 ] characters`
  - `expire_time` (string, optional)
    User-provided expiration time of the secret. This field indicates when the secret should no
     longer be used and may be displayed as a warning in the UI. It is purely informational and
     does not trigger any automatic actions or affect the secret's lifecycle.

## Returns

Returns the Secret object.

## Response

```json
{
  "name": "string",
  "owner": "string",
  "effective_owner": "string",
  "metastore_id": "string",
  "create_time": "string",
  "created_by": "string",
  "update_time": "string",
  "updated_by": "string",
  "comment": "string",
  "full_name": "string",
  "catalog_name": "string",
  "schema_name": "string",
  "value": "string",
  "effective_value": "string",
  "expire_time": "string"
}
```