# Replace certs URL: https://docs.hanzo.ai/docs/openapi/iam/put-iam-certs-by-owner-by-name > Changes a signing certificate's settings. `PUT /v1/iam/certs/{owner}/{name}` > [IAM →](https://docs.hanzo.ai/docs/openapi/iam) · [All API references →](https://docs.hanzo.ai/docs/openapi) · [Get started →](https://docs.hanzo.ai/docs/guides) | | | | ------------- | -------------------------------------------------- | | **Address** | `https://api.hanzo.ai/v1/iam/certs/{owner}/{name}` | | **Method** | `PUT` | | **Operation** | `put_iam_certs_by_owner_by_name` | | **Auth** | `Authorization: Bearer $HANZO_API_KEY` | Changes a signing certificate's settings. What it is called does not change, and neither does when it was added. A PUT here is a METADATA edit — display name, expiry, provider. It overlays only the fields the request actually SET onto the loaded row: a field the JSON omits (or leaves at its zero value) keeps what the row holds, rather than blanking it. That is load-bearing, not a nicety. A read serves the public Certificate (Mask hides only PrivateKey and AccessSecret), so a client that reads a cert, changes one field, and writes it back sends the masked halves empty and every other field it did not touch at its zero value — and the old full-struct overlay wrote all of those blanks back. Blanking CryptoAlgorithm alone drops the cert from the JWKS (oidc.Publishes turns false), so every token under its `kid` stops verifying; blanking Provider/Account/ExpireTime breaks ACME renewal and expiry — all from a request that only meant to rename it. Absent-or-zero means "unchanged", so the deployment (key) and a rotation (cert) remain the only way key or published material changes; the metadata API cannot clear it. The overlay is generic — it copies every set field, so a field nobody has added yet is carried without a line here — and leaves three things the request may not move: the bound Model (id, createdAt, key, snapshot), the natural key (owner/name address the row, they do not mutate it), and the creation stamp. ## Request 22 fields, body `application/json` (required). | Field | In | Type | Required | Description | | ------------------ | ---- | ------------------ | -------- | ----------- | | `owner` | path | string | yes | | | `name` | path | string | yes | | | `accessKey` | body | string | — | | | `accessSecret` | body | string | — | | | `account` | body | string | — | | | `bitSize` | body | integer (int64) | — | | | `certificate` | body | string | — | | | `createdAt` | body | string (date-time) | — | | | `createdTime` | body | string | — | | | `cryptoAlgorithm` | body | string | — | | | `deleted` | body | boolean | — | | | `displayName` | body | string | — | | | `domainExpireTime` | body | string | — | | | `expireInYears` | body | integer (int64) | — | | | `expireTime` | body | string | — | | | `id` | body | string | — | | | `name` | body | string | — | | | `owner` | body | string | — | | | `provider` | body | string | — | | | `scope` | body | string | — | | | `type` | body | string | — | | | `updatedAt` | body | string (date-time) | — | | ## Response | Status | Body | Meaning | | --------- | --------------- | ----------------- | | `200` | iam.Cert | ok | | `202` | Approval | held for approval | | `default` | problem-details | refused | `200` body — 20 fields. | Field | In | Type | Always | Description | | ------------------ | ---- | ------------------ | ------ | ----------- | | `accessKey` | body | string | — | | | `accessSecret` | body | string | — | | | `account` | body | string | — | | | `bitSize` | body | integer (int64) | — | | | `certificate` | body | string | — | | | `createdAt` | body | string (date-time) | — | | | `createdTime` | body | string | — | | | `cryptoAlgorithm` | body | string | — | | | `deleted` | body | boolean | — | | | `displayName` | body | string | — | | | `domainExpireTime` | body | string | — | | | `expireInYears` | body | integer (int64) | — | | | `expireTime` | body | string | — | | | `id` | body | string | — | | | `name` | body | string | — | | | `owner` | body | string | — | | | `provider` | body | string | — | | | `scope` | body | string | — | | | `type` | body | string | — | | | `updatedAt` | body | string (date-time) | — | | Failure carries the platform error shape — see [Errors](https://docs.hanzo.ai/docs/errors). ## Examples **CLI** ```bash hanzo iam certs owner set ``` **SDK** **.ts** ```ts import { Configuration, IamApi } from 'hanzoai'; const api = new IamApi(new Configuration({ accessToken: process.env.HANZO_API_KEY })); const { data } = await api.putIamCertsByOwnerByName({ owner: 'owner', name: 'name', accessKey: "", accessSecret: "" }); ``` **.py** ```python from hanzoai.cloud import ApiClient, Configuration from hanzoai.cloud.api import IamApi client = ApiClient(Configuration(access_token=os.environ["HANZO_API_KEY"])) result = IamApi(client).put_iam_certs_by_owner_by_name(owner='owner', name='name', access_key="", access_secret="") ``` **.go** ```go cfg := hanzoai.NewConfiguration() cfg.AddDefaultHeader("Authorization", "Bearer "+os.Getenv("HANZO_API_KEY")) client := hanzoai.NewAPIClient(cfg) resp, _, err := client.IamAPI.PutIamCertsByOwnerByName(context.Background()).Execute() if err != nil { return err } ``` **.rs** ```rust use hanzo_client::apis::{configuration::Configuration, iam_api}; let mut cfg = Configuration::new(); cfg.bearer_access_token = std::env::var("HANZO_API_KEY").ok(); let result = iam_api::put_iam_certs_by_owner_by_name(&cfg, Default::default()).await?; ``` **.java** ```java import ai.hanzo.cloud.ApiClient; import ai.hanzo.cloud.api.IamApi; ApiClient client = new ApiClient(); client.setBearerToken(System.getenv("HANZO_API_KEY")); var result = new IamApi(client).putIamCertsByOwnerByName(); ``` **HTTP** ```bash curl -X PUT https://api.hanzo.ai/v1/iam/certs// \ -H "Authorization: Bearer $HANZO_API_KEY" \ -H "Content-Type: application/json" \ -d '{ "accessKey": "", "accessSecret": "" }' ``` **MCP** MCP reaches **iam** through the `iam` tool, which names its 44 operations with its own verbs — this one among them, under a name only MCP declares. `describe` explains any of them: ```bash curl -X POST https://api.hanzo.ai/v1/mcp \ -H "Content-Type: application/json" \ -d '{ "jsonrpc": "2.0", "id": 1, "method": "tools/call", "params": { "name": "describe", "arguments": { "op": "list_iam_applications" } } }' ``` --- [IAM API](https://docs.hanzo.ai/docs/openapi/iam) · [All Hanzo APIs](https://docs.hanzo.ai/docs/openapi) · [Interactive reference](https://docs.hanzo.ai/docs/openapi/reference)