> This page is for Workforce.

> For clean Markdown of any page, append .md to the page URL.
> For a complete documentation index, see https://docs.merge.dev/llms.txt.
> For AI client integration (Claude Code, Cursor, etc.), connect to the MCP server at https://docs.merge.dev/_mcp/server.

# Update application credential

PATCH https://ah-api.merge.dev/api/v1/application-credentials/{id}/
Content-Type: application/json

Partially updates an OAuth application credential. Only fields included in the request body are updated; omitted fields are left unchanged. Pass null to explicitly clear a field (e.g. client_secret or external_id).

Reference: https://docs.merge.dev/merge-workforce/agent-handler/application-credentials/application-credentials-partial-update

## Authentication

- `Authorization` header (bearer token, required) — Token-based authentication with required prefix "Bearer"

## Request

### Path parameters

- `id` (string, required)

### Body (application/json)

This endpoint expects a PatchedApplicationCredentialUpdate.

- `client_id` (string, optional)
- `client_secret` (string, optional, nullable)
- `external_id` (string, optional, nullable)
- `oauth2_scopes_override` (string, optional, nullable) — Space-separated OAuth scopes to request instead of the connector's default scopes, applied to the OAuth option configured on this credential. Send an empty string to clear the override and revert to the connector defaults; a cleared override reads back as an empty string, while a field that was never set reads back as null. A value equal to the connector's default scopes is treated as no override and reads back as null.

## Response

### 200

- `id` (string, required)
- `connector_slug` (string, required)
- `client_id` (string, required)
- `external_id` (string, required, nullable)
- `is_global_default` (boolean, required)
- `created_at` (datetime, required)
- `modified_at` (datetime, required)
- `oauth2_scopes_override` (string, required, nullable)

## Examples

### Update client credentials (application/json)

**Request**

```json
{
  "client_id": "new-client-id",
  "client_secret": "new-secret"
}
```

**Response**

```json
{
  "id": "3c90c3c0-6d46-4b50-8888-8dd25736052f",
  "connector_slug": "jira",
  "client_id": "new-client-id",
  "external_id": "acme-corp",
  "is_global_default": false,
  "created_at": "2024-01-15T10:30:00Z",
  "modified_at": "2024-01-16T08:00:00Z",
  "oauth2_scopes_override": null
}
```

**SDK Code**

```python Update client credentials (application/json)
import requests

url = "https://ah-api.merge.dev/api/v1/application-credentials/:id/"

payload = {
    "client_id": "new-client-id",
    "client_secret": "new-secret"
}
headers = {
    "Authorization": "Bearer <token>",
    "Content-Type": "application/json"
}

response = requests.patch(url, json=payload, headers=headers)

print(response.json())
```

```javascript Update client credentials (application/json)
const url = 'https://ah-api.merge.dev/api/v1/application-credentials/:id/';
const options = {
  method: 'PATCH',
  headers: {Authorization: 'Bearer <token>', 'Content-Type': 'application/json'},
  body: '{"client_id":"new-client-id","client_secret":"new-secret"}'
};

try {
  const response = await fetch(url, options);
  const data = await response.json();
  console.log(data);
} catch (error) {
  console.error(error);
}
```

```go Update client credentials (application/json)
package main

import (
	"fmt"
	"strings"
	"net/http"
	"io"
)

func main() {

	url := "https://ah-api.merge.dev/api/v1/application-credentials/:id/"

	payload := strings.NewReader("{\n  \"client_id\": \"new-client-id\",\n  \"client_secret\": \"new-secret\"\n}")

	req, _ := http.NewRequest("PATCH", url, payload)

	req.Header.Add("Authorization", "Bearer <token>")
	req.Header.Add("Content-Type", "application/json")

	res, _ := http.DefaultClient.Do(req)

	defer res.Body.Close()
	body, _ := io.ReadAll(res.Body)

	fmt.Println(res)
	fmt.Println(string(body))

}
```

```ruby Update client credentials (application/json)
require 'uri'
require 'net/http'

url = URI("https://ah-api.merge.dev/api/v1/application-credentials/:id/")

http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true

request = Net::HTTP::Patch.new(url)
request["Authorization"] = 'Bearer <token>'
request["Content-Type"] = 'application/json'
request.body = "{\n  \"client_id\": \"new-client-id\",\n  \"client_secret\": \"new-secret\"\n}"

response = http.request(request)
puts response.read_body
```

```java Update client credentials (application/json)
import com.mashape.unirest.http.HttpResponse;
import com.mashape.unirest.http.Unirest;

HttpResponse<String> response = Unirest.patch("https://ah-api.merge.dev/api/v1/application-credentials/:id/")
  .header("Authorization", "Bearer <token>")
  .header("Content-Type", "application/json")
  .body("{\n  \"client_id\": \"new-client-id\",\n  \"client_secret\": \"new-secret\"\n}")
  .asString();
```

```php Update client credentials (application/json)
<?php
require_once('vendor/autoload.php');

$client = new \GuzzleHttp\Client();

$response = $client->request('PATCH', 'https://ah-api.merge.dev/api/v1/application-credentials/:id/', [
  'body' => '{
  "client_id": "new-client-id",
  "client_secret": "new-secret"
}',
  'headers' => [
    'Authorization' => 'Bearer <token>',
    'Content-Type' => 'application/json',
  ],
]);

echo $response->getBody();
```

```csharp Update client credentials (application/json)
using RestSharp;

var client = new RestClient("https://ah-api.merge.dev/api/v1/application-credentials/:id/");
var request = new RestRequest(Method.PATCH);
request.AddHeader("Authorization", "Bearer <token>");
request.AddHeader("Content-Type", "application/json");
request.AddParameter("application/json", "{\n  \"client_id\": \"new-client-id\",\n  \"client_secret\": \"new-secret\"\n}", ParameterType.RequestBody);
IRestResponse response = client.Execute(request);
```

```swift Update client credentials (application/json)
import Foundation

let headers = [
  "Authorization": "Bearer <token>",
  "Content-Type": "application/json"
]
let parameters = [
  "client_id": "new-client-id",
  "client_secret": "new-secret"
] as [String : Any]

let postData = JSONSerialization.data(withJSONObject: parameters, options: [])

let request = NSMutableURLRequest(url: NSURL(string: "https://ah-api.merge.dev/api/v1/application-credentials/:id/")! as URL,
                                        cachePolicy: .useProtocolCachePolicy,
                                    timeoutInterval: 10.0)
request.httpMethod = "PATCH"
request.allHTTPHeaderFields = headers
request.httpBody = postData as Data

let session = URLSession.shared
let dataTask = session.dataTask(with: request as URLRequest, completionHandler: { (data, response, error) -> Void in
  if (error != nil) {
    print(error as Any)
  } else {
    let httpResponse = response as? HTTPURLResponse
    print(httpResponse)
  }
})

dataTask.resume()
```

### Update scopes (application/json)

**Request**

```json
{
  "oauth2_scopes_override": "read:jira-work write:jira-work"
}
```

**Response**

```json
{
  "id": "3c90c3c0-6d46-4b50-8888-8dd25736052f",
  "connector_slug": "jira",
  "client_id": "new-client-id",
  "external_id": "acme-corp",
  "is_global_default": false,
  "created_at": "2024-01-15T10:30:00Z",
  "modified_at": "2024-01-16T08:00:00Z",
  "oauth2_scopes_override": null
}
```

**SDK Code**

```python Update scopes (application/json)
import requests

url = "https://ah-api.merge.dev/api/v1/application-credentials/:id/"

payload = { "oauth2_scopes_override": "read:jira-work write:jira-work" }
headers = {
    "Authorization": "Bearer <token>",
    "Content-Type": "application/json"
}

response = requests.patch(url, json=payload, headers=headers)

print(response.json())
```

```javascript Update scopes (application/json)
const url = 'https://ah-api.merge.dev/api/v1/application-credentials/:id/';
const options = {
  method: 'PATCH',
  headers: {Authorization: 'Bearer <token>', 'Content-Type': 'application/json'},
  body: '{"oauth2_scopes_override":"read:jira-work write:jira-work"}'
};

try {
  const response = await fetch(url, options);
  const data = await response.json();
  console.log(data);
} catch (error) {
  console.error(error);
}
```

```go Update scopes (application/json)
package main

import (
	"fmt"
	"strings"
	"net/http"
	"io"
)

func main() {

	url := "https://ah-api.merge.dev/api/v1/application-credentials/:id/"

	payload := strings.NewReader("{\n  \"oauth2_scopes_override\": \"read:jira-work write:jira-work\"\n}")

	req, _ := http.NewRequest("PATCH", url, payload)

	req.Header.Add("Authorization", "Bearer <token>")
	req.Header.Add("Content-Type", "application/json")

	res, _ := http.DefaultClient.Do(req)

	defer res.Body.Close()
	body, _ := io.ReadAll(res.Body)

	fmt.Println(res)
	fmt.Println(string(body))

}
```

```ruby Update scopes (application/json)
require 'uri'
require 'net/http'

url = URI("https://ah-api.merge.dev/api/v1/application-credentials/:id/")

http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true

request = Net::HTTP::Patch.new(url)
request["Authorization"] = 'Bearer <token>'
request["Content-Type"] = 'application/json'
request.body = "{\n  \"oauth2_scopes_override\": \"read:jira-work write:jira-work\"\n}"

response = http.request(request)
puts response.read_body
```

```java Update scopes (application/json)
import com.mashape.unirest.http.HttpResponse;
import com.mashape.unirest.http.Unirest;

HttpResponse<String> response = Unirest.patch("https://ah-api.merge.dev/api/v1/application-credentials/:id/")
  .header("Authorization", "Bearer <token>")
  .header("Content-Type", "application/json")
  .body("{\n  \"oauth2_scopes_override\": \"read:jira-work write:jira-work\"\n}")
  .asString();
```

```php Update scopes (application/json)
<?php
require_once('vendor/autoload.php');

$client = new \GuzzleHttp\Client();

$response = $client->request('PATCH', 'https://ah-api.merge.dev/api/v1/application-credentials/:id/', [
  'body' => '{
  "oauth2_scopes_override": "read:jira-work write:jira-work"
}',
  'headers' => [
    'Authorization' => 'Bearer <token>',
    'Content-Type' => 'application/json',
  ],
]);

echo $response->getBody();
```

```csharp Update scopes (application/json)
using RestSharp;

var client = new RestClient("https://ah-api.merge.dev/api/v1/application-credentials/:id/");
var request = new RestRequest(Method.PATCH);
request.AddHeader("Authorization", "Bearer <token>");
request.AddHeader("Content-Type", "application/json");
request.AddParameter("application/json", "{\n  \"oauth2_scopes_override\": \"read:jira-work write:jira-work\"\n}", ParameterType.RequestBody);
IRestResponse response = client.Execute(request);
```

```swift Update scopes (application/json)
import Foundation

let headers = [
  "Authorization": "Bearer <token>",
  "Content-Type": "application/json"
]
let parameters = ["oauth2_scopes_override": "read:jira-work write:jira-work"] as [String : Any]

let postData = JSONSerialization.data(withJSONObject: parameters, options: [])

let request = NSMutableURLRequest(url: NSURL(string: "https://ah-api.merge.dev/api/v1/application-credentials/:id/")! as URL,
                                        cachePolicy: .useProtocolCachePolicy,
                                    timeoutInterval: 10.0)
request.httpMethod = "PATCH"
request.allHTTPHeaderFields = headers
request.httpBody = postData as Data

let session = URLSession.shared
let dataTask = session.dataTask(with: request as URLRequest, completionHandler: { (data, response, error) -> Void in
  if (error != nil) {
    print(error as Any)
  } else {
    let httpResponse = response as? HTTPURLResponse
    print(httpResponse)
  }
})

dataTask.resume()
```

### Clear scopes override (application/json)

**Request**

```json
{
  "oauth2_scopes_override": ""
}
```

**Response**

```json
{
  "id": "3c90c3c0-6d46-4b50-8888-8dd25736052f",
  "connector_slug": "jira",
  "client_id": "new-client-id",
  "external_id": "acme-corp",
  "is_global_default": false,
  "created_at": "2024-01-15T10:30:00Z",
  "modified_at": "2024-01-16T08:00:00Z",
  "oauth2_scopes_override": null
}
```

**SDK Code**

```python Clear scopes override (application/json)
import requests

url = "https://ah-api.merge.dev/api/v1/application-credentials/:id/"

payload = { "oauth2_scopes_override": "" }
headers = {
    "Authorization": "Bearer <token>",
    "Content-Type": "application/json"
}

response = requests.patch(url, json=payload, headers=headers)

print(response.json())
```

```javascript Clear scopes override (application/json)
const url = 'https://ah-api.merge.dev/api/v1/application-credentials/:id/';
const options = {
  method: 'PATCH',
  headers: {Authorization: 'Bearer <token>', 'Content-Type': 'application/json'},
  body: '{"oauth2_scopes_override":""}'
};

try {
  const response = await fetch(url, options);
  const data = await response.json();
  console.log(data);
} catch (error) {
  console.error(error);
}
```

```go Clear scopes override (application/json)
package main

import (
	"fmt"
	"strings"
	"net/http"
	"io"
)

func main() {

	url := "https://ah-api.merge.dev/api/v1/application-credentials/:id/"

	payload := strings.NewReader("{\n  \"oauth2_scopes_override\": \"\"\n}")

	req, _ := http.NewRequest("PATCH", url, payload)

	req.Header.Add("Authorization", "Bearer <token>")
	req.Header.Add("Content-Type", "application/json")

	res, _ := http.DefaultClient.Do(req)

	defer res.Body.Close()
	body, _ := io.ReadAll(res.Body)

	fmt.Println(res)
	fmt.Println(string(body))

}
```

```ruby Clear scopes override (application/json)
require 'uri'
require 'net/http'

url = URI("https://ah-api.merge.dev/api/v1/application-credentials/:id/")

http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true

request = Net::HTTP::Patch.new(url)
request["Authorization"] = 'Bearer <token>'
request["Content-Type"] = 'application/json'
request.body = "{\n  \"oauth2_scopes_override\": \"\"\n}"

response = http.request(request)
puts response.read_body
```

```java Clear scopes override (application/json)
import com.mashape.unirest.http.HttpResponse;
import com.mashape.unirest.http.Unirest;

HttpResponse<String> response = Unirest.patch("https://ah-api.merge.dev/api/v1/application-credentials/:id/")
  .header("Authorization", "Bearer <token>")
  .header("Content-Type", "application/json")
  .body("{\n  \"oauth2_scopes_override\": \"\"\n}")
  .asString();
```

```php Clear scopes override (application/json)
<?php
require_once('vendor/autoload.php');

$client = new \GuzzleHttp\Client();

$response = $client->request('PATCH', 'https://ah-api.merge.dev/api/v1/application-credentials/:id/', [
  'body' => '{
  "oauth2_scopes_override": ""
}',
  'headers' => [
    'Authorization' => 'Bearer <token>',
    'Content-Type' => 'application/json',
  ],
]);

echo $response->getBody();
```

```csharp Clear scopes override (application/json)
using RestSharp;

var client = new RestClient("https://ah-api.merge.dev/api/v1/application-credentials/:id/");
var request = new RestRequest(Method.PATCH);
request.AddHeader("Authorization", "Bearer <token>");
request.AddHeader("Content-Type", "application/json");
request.AddParameter("application/json", "{\n  \"oauth2_scopes_override\": \"\"\n}", ParameterType.RequestBody);
IRestResponse response = client.Execute(request);
```

```swift Clear scopes override (application/json)
import Foundation

let headers = [
  "Authorization": "Bearer <token>",
  "Content-Type": "application/json"
]
let parameters = ["oauth2_scopes_override": ""] as [String : Any]

let postData = JSONSerialization.data(withJSONObject: parameters, options: [])

let request = NSMutableURLRequest(url: NSURL(string: "https://ah-api.merge.dev/api/v1/application-credentials/:id/")! as URL,
                                        cachePolicy: .useProtocolCachePolicy,
                                    timeoutInterval: 10.0)
request.httpMethod = "PATCH"
request.allHTTPHeaderFields = headers
request.httpBody = postData as Data

let session = URLSession.shared
let dataTask = session.dataTask(with: request as URLRequest, completionHandler: { (data, response, error) -> Void in
  if (error != nil) {
    print(error as Any)
  } else {
    let httpResponse = response as? HTTPURLResponse
    print(httpResponse)
  }
})

dataTask.resume()
```

### Clear client_secret (application/json)

**Request**

```json
{
  "client_secret": null
}
```

**Response**

```json
{
  "id": "3c90c3c0-6d46-4b50-8888-8dd25736052f",
  "connector_slug": "jira",
  "client_id": "new-client-id",
  "external_id": "acme-corp",
  "is_global_default": false,
  "created_at": "2024-01-15T10:30:00Z",
  "modified_at": "2024-01-16T08:00:00Z",
  "oauth2_scopes_override": null
}
```

**SDK Code**

```python Clear client_secret (application/json)
import requests

url = "https://ah-api.merge.dev/api/v1/application-credentials/:id/"

payload = { "client_secret": None }
headers = {
    "Authorization": "Bearer <token>",
    "Content-Type": "application/json"
}

response = requests.patch(url, json=payload, headers=headers)

print(response.json())
```

```javascript Clear client_secret (application/json)
const url = 'https://ah-api.merge.dev/api/v1/application-credentials/:id/';
const options = {
  method: 'PATCH',
  headers: {Authorization: 'Bearer <token>', 'Content-Type': 'application/json'},
  body: '{"client_secret":null}'
};

try {
  const response = await fetch(url, options);
  const data = await response.json();
  console.log(data);
} catch (error) {
  console.error(error);
}
```

```go Clear client_secret (application/json)
package main

import (
	"fmt"
	"strings"
	"net/http"
	"io"
)

func main() {

	url := "https://ah-api.merge.dev/api/v1/application-credentials/:id/"

	payload := strings.NewReader("{\n  \"client_secret\": null\n}")

	req, _ := http.NewRequest("PATCH", url, payload)

	req.Header.Add("Authorization", "Bearer <token>")
	req.Header.Add("Content-Type", "application/json")

	res, _ := http.DefaultClient.Do(req)

	defer res.Body.Close()
	body, _ := io.ReadAll(res.Body)

	fmt.Println(res)
	fmt.Println(string(body))

}
```

```ruby Clear client_secret (application/json)
require 'uri'
require 'net/http'

url = URI("https://ah-api.merge.dev/api/v1/application-credentials/:id/")

http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true

request = Net::HTTP::Patch.new(url)
request["Authorization"] = 'Bearer <token>'
request["Content-Type"] = 'application/json'
request.body = "{\n  \"client_secret\": null\n}"

response = http.request(request)
puts response.read_body
```

```java Clear client_secret (application/json)
import com.mashape.unirest.http.HttpResponse;
import com.mashape.unirest.http.Unirest;

HttpResponse<String> response = Unirest.patch("https://ah-api.merge.dev/api/v1/application-credentials/:id/")
  .header("Authorization", "Bearer <token>")
  .header("Content-Type", "application/json")
  .body("{\n  \"client_secret\": null\n}")
  .asString();
```

```php Clear client_secret (application/json)
<?php
require_once('vendor/autoload.php');

$client = new \GuzzleHttp\Client();

$response = $client->request('PATCH', 'https://ah-api.merge.dev/api/v1/application-credentials/:id/', [
  'body' => '{
  "client_secret": null
}',
  'headers' => [
    'Authorization' => 'Bearer <token>',
    'Content-Type' => 'application/json',
  ],
]);

echo $response->getBody();
```

```csharp Clear client_secret (application/json)
using RestSharp;

var client = new RestClient("https://ah-api.merge.dev/api/v1/application-credentials/:id/");
var request = new RestRequest(Method.PATCH);
request.AddHeader("Authorization", "Bearer <token>");
request.AddHeader("Content-Type", "application/json");
request.AddParameter("application/json", "{\n  \"client_secret\": null\n}", ParameterType.RequestBody);
IRestResponse response = client.Execute(request);
```

```swift Clear client_secret (application/json)
import Foundation

let headers = [
  "Authorization": "Bearer <token>",
  "Content-Type": "application/json"
]
let parameters = ["client_secret": ] as [String : Any]

let postData = JSONSerialization.data(withJSONObject: parameters, options: [])

let request = NSMutableURLRequest(url: NSURL(string: "https://ah-api.merge.dev/api/v1/application-credentials/:id/")! as URL,
                                        cachePolicy: .useProtocolCachePolicy,
                                    timeoutInterval: 10.0)
request.httpMethod = "PATCH"
request.allHTTPHeaderFields = headers
request.httpBody = postData as Data

let session = URLSession.shared
let dataTask = session.dataTask(with: request as URLRequest, completionHandler: { (data, response, error) -> Void in
  if (error != nil) {
    print(error as Any)
  } else {
    let httpResponse = response as? HTTPURLResponse
    print(httpResponse)
  }
})

dataTask.resume()
```