Update a proxy
Replaces the proxy's name, description, firewalls, user header, and trust. Needs ns:update. The credential and the proxy's own CA stay the same. Answered with 400 in the same cases as Create a proxy.
AuthorizationBearer <token>A personal or service access token, sent as Authorization: Bearer <token>. See access tokens.
namespace*stringThe namespace id.
proxy*stringThe proxy id.
application/json- body
The writable fields of a proxy.
name*stringA display name. Required.
description?stringA free-form description.
firewalls?array<string>The firewalls whose registries the proxy routes. Duplicates are dropped. Container (OCI) firewalls cannot be attached, and no two may cover the same host.
userHeader?stringHow the user identity header is read. Defaults to none.
"none""plain""base64"userHeaderName?stringThe header the user identity is read from. Defaults to X-Authenticated-User.
trust?stringThe CA the web proxy trusts. Defaults to dedicated. shared is accepted only when the deployment has a shared root.
"dedicated""shared"The updated proxy.
application/json- response
An endpoint a company web proxy, such as Zscaler, Prisma Access, or Squid, chains package registry traffic to. Requests for a host an attached firewall covers are served by that firewall. The CA's private key and the credential are never returned.
id*stringThe proxy id. Unique across all namespaces.
name*stringA display name.
description?stringA free-form description.
firewalls*array<string>The firewalls whose registries the proxy routes. No two cover the same host. A proxy with no firewalls cannot authenticate.
userHeader*stringHow the user identity header is read: none ignores it, plain reads it as the user name, base64 as the base64 of the user name. The value is recorded as proxyUser on log entries.
"none""plain""base64"userHeaderName*stringThe header the user identity is read from.
trust*stringThe CA the web proxy trusts: dedicated is the proxy's own CA, shared the deployment's shared root.
"dedicated""shared"caCertificatePem*stringThe proxy's own CA certificate, PEM encoded. Present for every proxy; when trust is shared the web proxy trusts the shared root instead.
caFingerprint*stringThe hex SHA-256 of the proxy's own CA certificate.
caExpiresAt*stringWhen the proxy's own CA expires. It is created valid for two years.
date-timesecretRotatedAt?stringWhen the credential was last rotated. Absent until the first rotation.
date-timecreatedAt?stringWhen the proxy was created.
date-timeupdatedAt?stringWhen the proxy was last changed.
date-timecurl -X PUT 'https://eu-sov-1.bytesafecloud.eu/v1/my-namespace-id/proxies/proxy-01kya2b7m3q8xz5n0hdr4wcv6t' \ -H 'Content-Type: application/json' \ -d '{ "name": "Zscaler, Stockholm office", "description": "Office egress", "firewalls": [ "npm-main" ], "userHeader": "plain", "userHeaderName": "X-Authenticated-User", "trust": "shared"}'{ "id": "proxy-01kya2b7m3q8xz5n0hdr4wcv6t", "name": "Zscaler, Stockholm office", "description": "Office egress", "firewalls": [ "npm-main" ], "userHeader": "plain", "userHeaderName": "X-Authenticated-User", "trust": "shared", "caCertificatePem": "-----BEGIN CERTIFICATE-----\nMIIBszCCAVmgAwIBAgIQ...\n-----END CERTIFICATE-----\n", "caFingerprint": "97ebbd4919033a7226e1c8b7f7fde3a4c2b1e0f9d8c7b6a5f4e3d2c1b0a99887", "caExpiresAt": "2028-11-04T09:30:00Z", "secretRotatedAt": "2026-11-05T10:12:00Z", "createdAt": "2026-11-05T09:30:00Z", "updatedAt": "2026-11-05T10:12:00Z"}