---
title: "Update Protection Key"
slug: "secretmanager-updateprotectionkey"
updated: 2026-09-17T10:25:43Z
published: 2026-09-17T10:25:43Z
canonical: "api.ncloud-docs.com/secretmanager-updateprotectionkey"
---

> ## Documentation Index
> Fetch the complete documentation index at: https://api.ncloud-docs.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Update Protection Key

Available in VPC

Change a secret protection key. The protection key of a secret in the `REVOKE` (deletion requested) status can't be changed.

## Request

This section describes the request format. The method and URI are as follows:

| Method | URI |
| --- | --- |
| PUT | /api/v1/secrets/{secretId}/protection-key |

### Request headers

For information about the headers common to all Secret Manager APIs, see [Secret Manager request headers](/docs/en/secretmanager-api-overview#%EC%9A%94%EC%B2%AD%ED%97%A4%EB%8D%94).

### Request path parameters

You can use the following path parameters with your request:

| Field | Type | Required | Description |
| --- | --- | --- | --- |
| `secretId` | String | Required | Secret ID - See [Get Secret List](/docs/en/secretmanager-getsecretlist). |

### Request body

You can include the following data in the body of your request:

| Field | Type | Required | Description |
| --- | --- | --- | --- |
| `protectionKeyType` | String | Required | Protection key type - `DEFAULT` (default) \| `USER_MANAGED_KEY` - `DEFAULT`: Default key - `USER_MANAGED_KEY`: User managed key |
| `kmsKeyTag` | String | Conditional | KMS key tag - See [Get Protection Key List](/docs/en/secretmanager-getprotectionkeylist). - Required if `protectionKeyType` is `USER_MANAGED_KEY` |
| `kmsBoundaryType` | String | Conditional | KMS Region isolation type - `GLOBAL` \| `ISOLATED` - `GLOBAL`: Global - `ISOLATED`: Isolation - Required for Korea (KR) Region - `ISOLATED` for Japan (JPN) Region |

### Request example

The request example is as follows:

```
curl --location --request PUT 'https://secretmanager.apigw.ntruss.com/api/v1/secrets/{secretId}/protection-key' \
--header 'x-ncp-apigw-timestamp: {Timestamp}' \
--header 'x-ncp-iam-access-key: {Access Key}' \
--header 'x-ncp-apigw-signature-v2: {API Gateway Signature}' \
--header 'Content-Type: application/json' \
--data '{
    "protectionKeyType": "USER_MANAGED_KEY",
    "kmsKeyTag": "*****a8e99ef1ba49b9c190a0cb4f6fb20cff86dd3a3017fd6ee05aea8b*****",
    "kmsBoundaryType": "GLOBAL"
}'
```

## Response

This section describes the response format.

### Response body

The response body includes the following data:

| Field | Type | Required | Description |
| --- | --- | --- | --- |
| `code` | String | - | Response code |
| `data` | Object | - | Response result |
| `data.secretId` | String | - | Secret ID |
| `data.protectionKey` | Object | - | Protection key information |
| `data.protectionKey.type` | String | - | Protection key type - `DEFAULT` (default) \| `USER_MANAGED_KEY` - `DEFAULT`: Default key - `USER_MANAGED_KEY`: User managed key |
| `data.protectionKey.kmsKeyTag` | String | - | KMS key tag |
| `data.protectionKey.kmsKeyName` | String | - | KMS key name |
| `data.protectionKey.kmsBoundaryType` | String | - | KMS Region isolation type - `GLOBAL` \| `ISOLATED` - `GLOBAL`: Global - `ISOLATED`: Isolation |

### Response status codes

For information about the HTTP status codes common to all Secret Manager APIs, see [Secret Manager response status codes](/docs/en/secretmanager-api-overview#%EC%9D%91%EB%8B%B5%EC%83%81%ED%83%9C%EC%BD%94%EB%93%9C).

### Response example

The response example is as follows:

```
{
    "code": "SUCCESS",
    "data": {
        "secretId": "*****687685109842348f7358629bca2a6b2491e8c2352718e7d312b183*****",
        "protectionKey": {
            "type": "USER_MANAGED_KEY",
            "kmsKeyTag": "*****a8e99ef1ba49b9c190a0cb4f6fb20cff86dd3a3017fd6ee05aea8b*****",
            "kmsKeyName": "test-***",
            "kmsBoundaryType": "GLOBAL"
        }
    }
}
```