> ## Documentation Index
> Fetch the complete documentation index at: https://docs.apinizer.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Update Keystore

> Updates an existing keystore and deploys it to environments. Can optionally update referenced JWKs when the keystore is updated.

## Endpoint

```
PUT /apiops/projects/{projectName}/keystores/{keystoreName}/
```

## Authentication

Requires a Personal API Access Token.

### Header

```
Authorization: Bearer YOUR_TOKEN
```

## Request

### Headers

| Header        | Value            | Required |
| ------------- | ---------------- | -------- |
| Authorization | Bearer `{token}` | Yes      |
| Content-Type  | application/json | Yes      |

### Path Parameters

| Parameter    | Type   | Required | Description                    |
| ------------ | ------ | -------- | ------------------------------ |
| projectName  | string | Yes      | Project name                   |
| keystoreName | string | Yes      | Name of the keystore to update |

### Query Parameters

| Parameter       | Type   | Required | Description                                                                                                                                    |
| --------------- | ------ | -------- | ---------------------------------------------------------------------------------------------------------------------------------------------- |
| jwkUpdateAction | string | No       | Action to take on referenced JWKs: `NULLIFY` (clear references) or `UPDATE` (re-parse and update JWKs). Defaults to `NULLIFY` if not provided. |
| updateScope     | string | No       | Scope for updating JWKs: `SAME_PROJECT` or `ALL_PROJECTS` (used when jwkUpdateAction is `UPDATE`)                                              |

### Request Body

The request body should contain a KeystoreUpdateDTO object with the following structure:

```json theme={null}
{
  "name": "updated-keystore",
  "description": "Updated keystore description",
  "keyStoreEnvironmentList": [
    {
      "environmentName": "production",
      "file": "base64-encoded-updated-keystore-file-content",
      "password": "updated-password",
      "alias": "updated-alias",
      "keyStoreType": "JKS"
    }
  ]
}
```

### Request Body Fields

| Field                   | Type           | Required | Description                    |
| ----------------------- | -------------- | -------- | ------------------------------ |
| name                    | string         | No       | Keystore name (can be changed) |
| description             | string         | No       | Keystore description           |
| keyStoreEnvironmentList | array\[object] | No       | List of keystore environments  |

### Keystore Environment Object

| Field           | Type            | Required | Description                                      |
| --------------- | --------------- | -------- | ------------------------------------------------ |
| environmentName | string          | Yes      | Environment name where keystore will be deployed |
| file            | string (base64) | Yes      | Base64-encoded keystore file content             |
| password        | string          | Yes      | Keystore password                                |
| alias           | string          | No       | Default alias for the keystore                   |
| keyStoreType    | string          | Yes      | Keystore type: `JKS` or `PKCS12`                 |

### Notes

* **Request Format**: This API uses `application/json` content type. Keystore file content must be base64-encoded and included in the JSON body (not uploaded as a file).
* All fields are optional - only provided fields will be updated
* `name` can be changed, but must remain unique within the project
* `environmentName` is used to identify the environment (not `environmentId`)
* Keystore file content must be base64-encoded if provided

## Response

Same as [Create Keystore](/api-reference/keys-secrets/crud/create-keystore) response format.

## cURL Example

### Example 1: Update Keystore with JWK Updates

```bash theme={null}
curl -X PUT \
  "https://demo.apinizer.com/apiops/projects/MyProject/keystores/my-keystore/?jwkUpdateAction=UPDATE&updateScope=SAME_PROJECT" \
  -H "Authorization: Bearer YOUR_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{
    "name": "updated-keystore",
    "description": "Updated keystore description",
    "keyStoreEnvironmentList": [
      {
        "environmentName": "production",
        "file": "base64-encoded-updated-keystore-file-content",
        "password": "updated-password",
        "alias": "updated-alias",
        "keyStoreType": "JKS"
      }
    ]
  }'
```

### Example 2: Update Keystore and Clear JWK References

```bash theme={null}
curl -X PUT \
  "https://demo.apinizer.com/apiops/projects/MyProject/keystores/my-keystore/?jwkUpdateAction=NULLIFY" \
  -H "Authorization: Bearer YOUR_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{
    "description": "Updated description only",
    "keyStoreEnvironmentList": [
      {
        "environmentName": "production",
        "file": "base64-encoded-updated-keystore-file-content",
        "password": "updated-password",
        "alias": "updated-alias",
        "keyStoreType": "PKCS12"
      }
    ]
  }'
```

### Example 3: Update Keystore Name Only

```bash theme={null}
curl -X PUT \
  "https://demo.apinizer.com/apiops/projects/MyProject/keystores/my-keystore/" \
  -H "Authorization: Bearer YOUR_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{
    "name": "new-keystore-name"
  }'
```

## Notes and Warnings

* **Keystore Name**:
  * Can be changed during update
  * New name must be unique within the project
  * If name is changed, the keystore will be accessible by the new name

* **Referenced JWKs**:
  * If `jwkUpdateAction=UPDATE`, JWKs created from this keystore will be re-parsed and updated
  * If `jwkUpdateAction=NULLIFY` or not provided (default), JWK references will be cleared
  * `updateScope` determines which JWKs to update when `jwkUpdateAction=UPDATE`: `SAME_PROJECT` or `ALL_PROJECTS`
  * Default behavior (`NULLIFY`) ensures JWKs don't reference deleted or updated keystores

* **Environment Name**:
  * Use `environmentName` (not `environmentId`) to specify the environment
  * Environment name must exist and be accessible

* **Keystore Type**:
  * `keyStoreType` must match the actual keystore file format
  * `JKS`: Java KeyStore format
  * `PKCS12`: PKCS#12 format (also known as .p12 or .pfx)

* **Partial Updates**:
  * Only provided fields will be updated
  * Omitted fields will remain unchanged

* **Automatic Deployment**:
  * Keystore is automatically deployed to all specified environments after update
  * Deployment results are returned in the response

## Permissions

User must have **`SECRETS` + `MANAGE`** permission in the project. For deployment operations (when deploying keystores to environments), user must also have **`SECRETS` + `DEPLOY_UNDEPLOY`** permission.

## Related Documentation

* [List Keystores](/api-reference/keys-secrets/crud/list-keystores) - List all keystores
* [Create Keystore](/api-reference/keys-secrets/crud/create-keystore) - Create a new keystore