> ## Documentation Index > Fetch the complete documentation index at: https://docs.2501.ai/llms.txt > Use this file to discover all available pages before exploring further. # Update a plugin > Partial update. Omitted fields remain unchanged. The name can be changed. A plugin of an organization cannot share its name with another plugin of that organization or with a tenant-wide plugin, and a tenant-wide plugin cannot share it with any plugin of the tenant, ignoring case (409 otherwise). A connection replaces the complete connection object and cannot be removed. A plugin without a connection can take one, and a plugin can switch between an MCP endpoint and a hosted MCP server, only in an update that leaves it disabled. Updating a hosted MCP server plugin in any way, or switching a plugin to one, takes a tenant-level administrator (403 otherwise). A bearer or API key connection names the Secret or Vault path credential it sends in authentication.credential_id, of the plugin organization or tenant-wide; it may be left out while the plugin is disabled, and enabling it without one returns 400. Moving the plugin to an organization returns 409 (details.reason plugin_move_blocked) while agents or specialties outside it still hold it; details.agent_ids or details.specialty_ids lists them. ## OpenAPI ````yaml /0.17/openapi.json post /api/v1/plugins/{id} openapi: 3.0.3 info: title: 2501 Public API version: v1 description: >- The stable, versioned HTTP API for driving 2501 as code. See the API Overview for authentication, the org_id rule, cursor pagination, and the error envelope. servers: - url: https://{command_center_host} variables: command_center_host: default: your-command-center-host description: Your Command Center host security: - bearerAuth: [] paths: /api/v1/plugins/{id}: post: tags: - Plugins summary: Update a plugin description: >- Partial update. Omitted fields remain unchanged. The name can be changed. A plugin of an organization cannot share its name with another plugin of that organization or with a tenant-wide plugin, and a tenant-wide plugin cannot share it with any plugin of the tenant, ignoring case (409 otherwise). A connection replaces the complete connection object and cannot be removed. A plugin without a connection can take one, and a plugin can switch between an MCP endpoint and a hosted MCP server, only in an update that leaves it disabled. Updating a hosted MCP server plugin in any way, or switching a plugin to one, takes a tenant-level administrator (403 otherwise). A bearer or API key connection names the Secret or Vault path credential it sends in authentication.credential_id, of the plugin organization or tenant-wide; it may be left out while the plugin is disabled, and enabling it without one returns 400. Moving the plugin to an organization returns 409 (details.reason plugin_move_blocked) while agents or specialties outside it still hold it; details.agent_ids or details.specialty_ids lists them. parameters: - schema: type: string required: true name: id in: path requestBody: required: true content: application/json: schema: type: object properties: name: type: string minLength: 1 maxLength: 255 description: type: string maxLength: 2000 connection: oneOf: - $ref: '#/components/schemas/PluginEndpointConnectionInput' - $ref: '#/components/schemas/PluginHostedServerConnectionInput' - nullable: true enabled: type: boolean org_id: type: string nullable: true trusted_issuer: type: string maxLength: 2048 format: uri description: >- OAuth only: the authorization server the MCP server names, trusted from this save on. Ignored when the plugin already trusts one. additionalProperties: false responses: '200': description: The updated plugin content: application/json: schema: $ref: '#/components/schemas/Plugin' '400': description: >- Bad request - a field is missing, malformed, or not allowed (VALIDATION_FAILED, BAD_REQUEST, INVALID_CURSOR) content: application/json: schema: $ref: '#/components/schemas/Error' '401': description: >- No credentials, or a key that is invalid, revoked, or expired (UNAUTHORIZED) content: application/json: schema: $ref: '#/components/schemas/Error' '403': description: >- Authenticated but not allowed (FORBIDDEN, ORG_ACCESS_DENIED, STEP_UP_REFUSED, TWO_FACTOR_ENROLLMENT_REQUIRED, LICENSE_CAP_REACHED, LICENSE_EXPIRED) content: application/json: schema: $ref: '#/components/schemas/Error' '404': description: No such row that this caller can see (NOT_FOUND) content: application/json: schema: $ref: '#/components/schemas/Error' '409': description: >- The write conflicts with existing data (CONFLICT, DUPLICATE_KEY, FOREIGN_KEY_VIOLATION, RESOURCE_IN_USE) content: application/json: schema: $ref: '#/components/schemas/Error' components: schemas: PluginEndpointConnectionInput: type: object properties: transport: type: string enum: - streamable-http - http-sse url: type: string format: uri authentication: oneOf: - type: object properties: method: type: string enum: - anonymous required: - method additionalProperties: false - type: object properties: method: type: string enum: - bearer credential_id: type: string description: The Secret or Vault path credential the plugin sends required: - method additionalProperties: false - type: object properties: method: type: string enum: - oauth scopes: type: array items: type: string pattern: ^[\x21\x23-\x5B\x5D-\x7E]+$ audience: type: string minLength: 1 maxLength: 2048 description: >- The API the tokens are for, sent as the `audience` parameter of the authorization and token requests, as Auth0 asks for. metadata_url: type: string maxLength: 2048 format: uri description: >- Where the authorization server publishes its metadata, for a server whose metadata does not live at its issuer, such as Azure AD B2C. Discovery reads it instead of the server the MCP server names, and the plugin trusts the issuer it names. grant: type: string enum: - authorization_code - client_credentials client: oneOf: - type: object properties: registration: type: string enum: - pre_registered client_id: type: string minLength: 1 client_secret_credential_id: type: string private_key: type: object properties: credential_id: type: string description: >- The Secret or Vault path credential holding the PKCS #8 PEM private key key_id: type: string minLength: 1 maxLength: 256 description: The `kid` the provider knows the public key by algorithm: type: string enum: - RS256 - ES256 required: - credential_id additionalProperties: false description: >- Authenticate the client with a JWT signed by its private key (`private_key_jwt`, RFC 7523) instead of a client secret. RS256 unless `algorithm` says otherwise. callback: type: string enum: - shared - per_provider description: >- Where the provider sends the browser back after consent: `per_provider`, a callback address of the plugin's authorization server alone, so a provider that does not name itself in its answer can sign in a client without a secret; absent or `shared`, the address every provider shares. required: - registration - client_id additionalProperties: false - type: object properties: registration: type: string enum: - automatic required: - registration additionalProperties: false - type: object properties: registration: type: string enum: - dynamic required: - registration additionalProperties: false required: - method - client additionalProperties: false - type: object properties: method: type: string enum: - api-key header_name: type: string pattern: ^[!#$%&'*+.^_`|~0-9A-Za-z-]+$ description: >- HTTP authentication header. Reserved HTTP transport and MCP session headers are not accepted. credential_id: type: string description: The Secret or Vault path credential the plugin sends required: - method - header_name additionalProperties: false required: - transport - url - authentication additionalProperties: false PluginHostedServerConnectionInput: type: object properties: transport: type: string enum: - stdio image: type: string maxLength: 255 pattern: >- ^(?:[A-Za-z0-9-]+(?:\.[A-Za-z0-9-]+)*(?::\d+)?\/)?[a-z0-9]+(?:(?:[._]|__|-+)[a-z0-9]+)*(?:\/[a-z0-9]+(?:(?:[._]|__|-+)[a-z0-9]+)*)*(?::\w[\w.-]{0,127})?(?:@sha256:[a-f0-9]{64})?$ args: type: array items: type: string maxLength: 4096 maxItems: 64 env: type: array items: anyOf: - type: object properties: name: type: string maxLength: 128 pattern: ^[A-Za-z_][A-Za-z0-9_]*$ value: type: string maxLength: 4096 required: - name - value additionalProperties: false - type: object properties: name: type: string maxLength: 128 pattern: ^[A-Za-z_][A-Za-z0-9_]*$ credential_id: type: string required: - name - credential_id additionalProperties: false maxItems: 64 required: - transport - image - args - env additionalProperties: false Plugin: type: object properties: description: type: string connection: oneOf: - $ref: '#/components/schemas/PluginEndpointConnection' - $ref: '#/components/schemas/PluginHostedServerConnection' - nullable: true hosted_server: type: boolean description: >- Whether the plugin runs a hosted MCP server, also when its stored connection is unreadable and sent as null. id: type: string name: type: string enabled: type: boolean tenant_id: type: string org_id: type: string nullable: true created_at: type: string format: date-time updated_at: type: string format: date-time required: - description - connection - hosted_server - id - name - enabled - tenant_id - org_id - created_at - updated_at Error: type: object properties: code: type: string example: VALIDATION_FAILED message: type: string example: Validation failed request_id: type: string example: req_3702b7e7-... field: type: string description: Set when one input is at fault errors: type: array items: type: object properties: field: type: string message: type: string required: - field - message description: Set when several inputs are at fault details: type: object additionalProperties: nullable: true required: - code - message - request_id PluginEndpointConnection: type: object properties: transport: type: string enum: - streamable-http - http-sse url: type: string authentication: oneOf: - type: object properties: method: type: string enum: - anonymous required: - method - type: object properties: method: type: string enum: - bearer credential_id: type: string description: The Secret or Vault path credential the plugin sends required: - method - type: object properties: method: type: string enum: - oauth scopes: type: array items: type: string pattern: ^[\x21\x23-\x5B\x5D-\x7E]+$ audience: type: string minLength: 1 maxLength: 2048 description: >- The API the tokens are for, sent as the `audience` parameter of the authorization and token requests, as Auth0 asks for. metadata_url: type: string description: >- Where the authorization server publishes its metadata, for a server whose metadata does not live at its issuer, such as Azure AD B2C. Discovery reads it instead of the server the MCP server names, and the plugin trusts the issuer it names. grant: type: string enum: - authorization_code - client_credentials client: oneOf: - type: object properties: registration: type: string enum: - pre_registered client_id: type: string minLength: 1 client_secret_credential_id: type: string private_key: type: object properties: credential_id: type: string description: >- The Secret or Vault path credential holding the PKCS #8 PEM private key key_id: type: string minLength: 1 maxLength: 256 description: The `kid` the provider knows the public key by algorithm: type: string enum: - RS256 - ES256 required: - credential_id description: >- Authenticate the client with a JWT signed by its private key (`private_key_jwt`, RFC 7523) instead of a client secret. RS256 unless `algorithm` says otherwise. callback: type: string enum: - shared - per_provider description: >- Where the provider sends the browser back after consent: `per_provider`, a callback address of the plugin's authorization server alone, so a provider that does not name itself in its answer can sign in a client without a secret; absent or `shared`, the address every provider shares. required: - registration - client_id - type: object properties: registration: type: string enum: - automatic required: - registration - type: object properties: registration: type: string enum: - dynamic required: - registration required: - method - client - type: object properties: method: type: string enum: - api-key header_name: type: string credential_id: type: string description: The Secret or Vault path credential the plugin sends required: - method - header_name required: - transport - url - authentication PluginHostedServerConnection: type: object properties: transport: type: string enum: - stdio image: type: string args: type: array items: type: string maxItems: 64 env: type: array items: anyOf: - type: object properties: name: type: string value: type: string required: - name - value - type: object properties: name: type: string credential_id: type: string required: - name - credential_id maxItems: 64 required: - transport - image - args - env securitySchemes: bearerAuth: type: http scheme: bearer description: >- An API key minted in Command Center (Settings -> API Keys), sent as `Authorization: Bearer 2501_ak_...`. A Command Center session cookie is also accepted. ```` This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.