Update Route
PATCH /v1/routes/:id
Path Parameters
| Parameter | Type | Description |
|---|---|---|
id | uuid | The route ID |
Request Body
All fields are optional. Only provided fields will be updated.| Field | Type | Description |
|---|---|---|
name | string | Display name |
enabled | boolean | Enable or disable the route |
requires_clients | boolean | Whether requests must come from an authorized client |
target_base_url | string | Upstream API base URL |
inject_headers_json | object | Headers to inject |
inject_body_json | object | Body fields to inject |
intercept_enabled | boolean | Per-environment field (the base environment): opt into route-aware interception. Turning it on is refused with 409 intercept_route_conflict when another intercept-enabled route already covers the same upstream host and base path in that environment. |
method_configs | object | Per-HTTP-method configuration |
injection_rules | object[] | Removed. A non-empty value is rejected with 400 — it was stored and applied to nothing. Use {{secret_id:<uuid>}} / {{secret:<name>}} placeholders in the request body your client sends, for a secret the route’s own templates already send (which secrets a client may name). An empty array is still accepted as a no-op. |
require_signature | boolean | Require request signature validation |
signature_tolerance_sec | number | Signature timestamp tolerance in seconds |
rate_limit_enabled | boolean | Enable rate limiting |
rate_limit_requests | number | Max requests per window |
rate_limit_window_sec | number | Rate limit window in seconds |
rate_limit_burst | number | Burst allowance |
allowed_methods | string[] | Restrict to specific HTTP methods |
http_method_restrictions_enabled | boolean | Enable method restrictions |
egress_server_id | string | Route through a specific egress/VPN server |
ip_allowlist | string[] | Allowed IP addresses or CIDR ranges |
data_plane_node_id | string | Assign to a specific data plane node |
Response
Returns the updated route object.Errors
| Status | Type | Description |
|---|---|---|
| 400 | validation_error | No valid fields provided |
| 403 | forbidden | The route carries a standing decrypt or detokenize field action and this write would give it a destination it does not already store, or switch on one it stores but does not send to: a token issued to a person is refused whatever the role, and a key must hold the action’s own permission (transit:decrypt / vault:detokenize). See Moving a route that decrypts or detokenizes. |
| 403 | insufficient_scope | The same, for an OAuth token narrowed to scopes that do not include the action’s own (transit:decrypt / vaults:detokenize); the WWW-Authenticate header names it. |
| 404 | not_found | Route not found |