FurniOpsDocs
API referenceSources

Set a source's credentials

Replaces the source's credentials. They are sealed under the source's ID as they arrive and never returned; the response shows only has_credentials.

  • Scopessources:write
  • Rate classwrite
PUT/v1/sources/{id}/credentials

Replaces the source's credentials. They are sealed under the source's ID as they arrive and never returned; the response shows only has_credentials.

Authorization

apiKey
AuthorizationBearer <token>

An API key (fo_live_… / fo_test_…) as a bearer token

In: header

Path Parameters

id*string

Source (a vendor connection) ID

Match^src_[0-9A-Za-z]{22}$

Header Parameters

FurniOps-Version?string

Dated API version; pinned per organisation on first use and overridable per request

Value in

  • "2026-10-01"
  • "2026-10-04"
FurniOps-Mode?string

The data the request acts on: test is the organisation's sandbox. An OAuth token picks it (live by default); an API key's mode is fixed, and naming the other one is refused

Value in

  • "live"
  • "test"
FurniOps-Dry-Run?string

Preview the write and change nothing: true answers the would-be response, explain a Preview (application/vnd.furniops.preview+json)

Value in

  • "true"
  • "explain"

Request Body

application/json

TypeScript Definitions

Use the request body type in TypeScript.

Replaces the source's credentials; write-only, never returned

Response Body

application/json

application/problem+json

application/problem+json

application/problem+json

application/problem+json

application/problem+json

application/problem+json

application/problem+json

application/problem+json

application/problem+json

curl -X PUT "https://example.com/v1/sources/string/credentials" \  -H "Content-Type: application/json" \  -d '{    "values": {      "property1": "string",      "property2": "string"    }  }'
{  "object": "source",  "id": "string",  "catalogue": "string",  "name": "string",  "kind": "api",  "connector": "string",  "config": {    "url": "http://example.com",    "platform": "shopify",    "format": "csv",    "currency": "usd",    "decimal": "dot",    "role": "supplier",    "warehouse": "string",    "price_code": "string",    "inbound": {      "senders": [        "string"      ]    }  },  "schedule": {    "interval_minutes": 15,    "stock_interval_minutes": 15,    "adaptive": true  },  "status": "active",  "status_reason": {    "code": "fetch_refused",    "message": "string"  },  "licence_basis": "vendor_agreement",  "first_party": true,  "has_credentials": true,  "freshness": {    "catalogue": null,    "stock": null  },  "inbound_address": "[email protected]",  "version": 1,  "created_at": "2019-08-24T14:15:22Z",  "updated_at": "2019-08-24T14:15:22Z"}

Rotate a source's inbound address POST

Gives the source a new inbound address at once; mail to the old one is refused from then on. For an address that leaked. Sources without `config.inbound` answer 422.

Test a source POST

Reaches the source once, as a run would, and reports what it answered; nothing is stored. A source fetched from a URL is asked for it; an API source's connector signs in with the stored credentials. Kinds that are not fetched (files) answer 422.