Update a Provider Configuration

Use this endpoint to update an existing provider configuration. If the configuration payload changes, it is re-validated against the provider’s JSON Schema.

PATCH /v1/provider-configurations/{id}

Update a Provider Configuration

cURL

curl --request PATCH \
  --url https://flowker.sandbox.lerian.net/v1/provider-configurations/{id} \
  --header 'Authorization: Bearer <token>' \
  --header 'Content-Type: application/json' \
  --data '
{
  "allowedHosts": [
    "api.acme.com",
    ".kyc-provider.io"
  ],
  "allowedPrivateHosts": [
    "nginx.pix-inline.internal"
  ],
  "config": {},
  "description": "ClearSale anti-fraud — updated with new API version",
  "metadata": {},
  "name": "ClearSale Production v2",
  "schemaBindings": [
    {
      "schemaId": "018f3e2a-1c4d-7b9e-a1b2-c3d4e5f6a7b8",
      "type": "openapi",
      "operations": [
        {
          "method": "POST",
          "path": "/payments"
        }
      ]
    }
  ]
}
'

200

{
  "id": "c3d4e5f6-a7b8-9012-cdef-345678901234",
  "name": "ClearSale Production",
  "description": "ClearSale anti-fraud for Pix transactions",
  "providerId": "clearsale",
  "kind": "catalog",
  "config": {
    "baseUrl": "https://api.clearsale.com.br",
    "environment": "production"
  },
  "allowedHosts": [
    "api.clearsale.com.br"
  ],
  "schemaBindings": [],
  "status": "active",
  "metadata": {
    "team": "risk"
  },
  "createdAt": "2026-03-17T14:00:00Z",
  "updatedAt": "2026-03-17T14:00:00Z"
}

Authorizations

Authorization · string · header · required

JWT bearer token issued by the identity provider. Send it in the Authorization header as Bearer <token>.

Path Parameters

id · string<uuid> · required

Unique identifier of the provider configuration.

Body

application/json

Request body containing the updated provider configuration details.

allowedHosts · string[]

Replaces the outbound allow-list. Omit the field to leave the stored list unchanged. Send an empty list to clear it, and a non-empty list to replace it. The new list must satisfy the same rules as on create, including the base-URL coverage check and the generic HTTP provider rule.

Maximum array length: 100

Maximum string length: 253

Example:

["api.acme.com", ".kyc-provider.io"]

allowedPrivateHosts · string[]

Replaces the named private-host allowance. Omit the field to leave the stored set unchanged. Send an empty list to clear it, and a non-empty list to replace it. Entries follow the same format as on create.

Maximum array length: 100

Maximum string length: 253

Example:

["nginx.pix-inline.internal"]

config · object

Updated provider-specific configuration.

Show child attributes

description · string

Updated description.

Maximum string length: 500

Example:

"ClearSale anti-fraud — updated with new API version"

metadata · object

Updated metadata.

Show child attributes

name · string

Updated name.

Required string length: 1 - 100

Example:

"ClearSale Production v2"

schemaBindings · object[]

Replaces the schema bindings. Omit the field to leave the stored bindings unchanged. Send an empty list to remove them all, and a non-empty list to replace the set. Flowker checks every entry against the stored schemas before it saves anything.

Maximum array length: 100

Show child attributes

Response

200

application/json

Indicates that the request was successful and the response contains the requested data.

config · object · required

Provider-specific configuration.

Show child attributes

Example:

{
  "baseUrl": "https://api.clearsale.com.br",
  "environment": "production"
}

createdAt · string<date-time> · required

Timestamp when the configuration was created.

Example:

"2026-03-17T14:00:00Z"

id · string<uuid> · required

Unique identifier of the configuration.

Example:

"c3d4e5f6-a7b8-9012-cdef-345678901234"

kind · enum<string> · required

Connection kind of this configuration: catalog targets a provider published in the catalog, and external_openapi targets an OpenAPI document registered for your tenant.

Available options: catalog, external_openapi

Example:

"catalog"

name · string · required

Name of the configuration.

Example:

"ClearSale Production"

providerId · string · required

ID of the catalog provider this configuration targets. A configuration of kind external_openapi created without one carries the reserved id external.openapi instead.

Example:

"clearsale"

schemaBindings · object[] · required

Stored schemas this configuration binds to. The field is always present, and it is an empty list when the configuration binds no schema.

Show child attributes

status · enum<string> · required

Current status: active or disabled.

Available options: active, disabled

Example:

"active"

updatedAt · string<date-time> · required

Timestamp of the last update.

Example:

"2026-03-17T14:00:00Z"

allowedHosts · string[]

Outbound allow-list of destination hostnames. The field is absent when the configuration declares no allow-list.

Maximum array length: 100

Maximum string length: 253

Example:

["api.clearsale.com.br"]

allowedPrivateHosts · string[]

Named private hosts this configuration may reach, managed by your operations team. The field is absent when the set is empty.

Maximum array length: 100

Maximum string length: 253

Example:

["nginx.pix-inline.internal"]

description · string

Human-readable description.

Example:

"ClearSale anti-fraud for Pix transactions"

metadata · object

Custom metadata.

Show child attributes

Example:

{
  "environment": "production",
  "team": "risk"
}