# Update a PKI trust store (/docs/apis/management/trust-stores/PatchPkiTrustStore)

`PATCH /truststores/pki/{trust_store_id}`

Applies a partial update to the specified PKI trust store. Only fields included in the request are updated.

Base URL: `https://{tenant}.{region}.monocloud.com/api`, where `{tenant}`, `{region}` (one of us, eu, in) come from your tenant. Authentication: send your Management API key in the `X-API-KEY` header.

## Parameters

- `trust_store_id` (path) (string, required) The unique identifier of the trust store.

## Request body

JSON, required. The request payload used to update a trust store.

- `name` (string) Human-readable name for the trust store.
- `enabled` (boolean) Indicates whether the trust store is enabled.
- `show_in_discovery_document` (boolean) Specifies whether this trust store’s mTLS endpoint aliases are published under `mtls_additional_endpoint_aliases` in the OpenID Connect discovery document.
- `cert_chain` (string) PEM-encoded certificate chain (concatenated), used as the trust anchor and intermediates for mTLS validation.
- `options` (PatchPkiTrustStoreOptionsRequest) Trust store validation settings (certificate type, revocation, caching, and related policies).
  - `validate_certificate_use` (boolean) Indicates whether the client certificate is validated for client authentication, including Client Authentication EKU checks across the certificate chain.
  - `validate_validity_period` (boolean) Indicates whether the certificate validity period (`NotBefore` / `NotAfter`) is enforced.
  - `revocation_mode` (string) Specifies how certificate revocation status is evaluated. One of: `no_check`, `online`, `offline`.
  - `revocation_check_depth` (string) Specifies how revocation checks are applied across the certificate chain. One of: `end_certificate_only`, `exclude_root`, `entire_chain`.
  - `revocation_check_clock_skew` (integer, int32) Specifies the allowed clock skew used when validating CRL issuance times and OCSP responses (in seconds).
  - `ocsp_check_timeout` (integer, int32) Specifies the timeout for OCSP responder calls when online revocation checking is enabled (in seconds).
  - `online_crl_check_timeout` (integer, int32) Specifies the timeout for downloading CRLs from certificate distribution points (CDPs) when online revocation checking is enabled (in seconds).
  - `certificate_auth_cache_duration` (integer, int32) Specifies how long certificate authentication results are cached (in seconds).
  - `ocsp_cache_duration` (integer, int32) Specifies how long OCSP responses are cached when online OCSP checking is enabled (in seconds).
  - `online_crl_cache_duration` (integer, int32) Specifies how long downloaded CRLs are cached when online CRL checking is enabled (in seconds).

## Response body

`200`, JSON. The trust store was updated successfully

Returns `PkiTrustStore`.

- `id` (string, required) The unique identifier of the trust store.
- `name` (string, required) Human-readable name for the trust store.
- `enabled` (boolean, required) Indicates whether the trust store is enabled.
- `is_default` (boolean, required) Indicates whether this trust store is configured as the default store for the mTLS endpoint.
- `show_in_discovery_document` (boolean, required) Specifies whether this trust store’s mTLS endpoint aliases are published under `mtls_additional_endpoint_aliases` in the OpenID Connect discovery document.
- `options` (PkiTrustStoreOptions, required) Trust store validation settings (certificate type, revocation, caching, and related policies).
  - `validate_certificate_use` (boolean, required) Indicates whether the client certificate is validated for client authentication, including Client Authentication EKU checks across the certificate chain.
  - `validate_validity_period` (boolean, required) Indicates whether the certificate validity period (`NotBefore` / `NotAfter`) is enforced.
  - `revocation_mode` (string, required) Specifies how certificate revocation status is evaluated. One of: `no_check`, `online`, `offline`.
  - `revocation_check_depth` (string, required) Specifies how revocation checks are applied across the certificate chain. One of: `end_certificate_only`, `exclude_root`, `entire_chain`.
  - `revocation_check_clock_skew` (integer, required, int32) Specifies the allowed clock skew used when validating CRL issuance times and OCSP responses (in seconds).
  - `ocsp_check_timeout` (integer, required, int32) Specifies the timeout for OCSP responder calls when online revocation checking is enabled (in seconds).
  - `online_crl_check_timeout` (integer, required, int32) Specifies the timeout for downloading CRLs from certificate distribution points (CDPs) when online revocation checking is enabled (in seconds).
  - `certificate_auth_cache_duration` (integer, required, int32) Specifies how long certificate authentication results are cached (in seconds).
  - `ocsp_cache_duration` (integer, required, int32) Specifies how long OCSP responses are cached when online OCSP checking is enabled (in seconds).
  - `online_crl_cache_duration` (integer, required, int32) Specifies how long downloaded CRLs are cached when online CRL checking is enabled (in seconds).
- `creation_time` (integer, required, date-time) Specifies the creation time of the trust store (in Epoch).
- `last_updated` (integer, required, date-time) Specifies the last update time of the trust store (in Epoch).
- `cert_chain` (string, required) PEM-encoded certificate chain (concatenated), used as the trust anchor and intermediates for mTLS validation.

## Errors

- `400` Bad Request
  - `type` (string, required) A URI reference that identifies the error type. When accessed, it may provide human-readable documentation.
  - `title` (string, required) A short, human-readable summary of the error.
  - `status` (integer, required, int32) The HTTP status code associated with this error response.
  - `trace_id` (string, required) A unique identifier for the request, used for tracing and diagnostics.
  - `detail` (string) A human-readable explanation specific to this occurrence of the error.
  - `instance` (string) A URI reference that identifies the specific occurrence of the error.
- `401` Unauthorized
- `402` Payment Required
  Same body as `400`.
- `403` Forbidden
- `404` Not Found
  Same body as `400`.
- `422` Unprocessable Entity
  - `type` (string, required) A URI reference that identifies the error type. When accessed, it may provide human-readable documentation.
  - `title` (string, required) A short, human-readable summary of the error.
  - `status` (integer, required, int32) The HTTP status code associated with this error response.
  - `trace_id` (string, required) A unique identifier for the request, used for tracing and diagnostics.
  - `detail` (string) A human-readable explanation specific to this occurrence of the error.
  - `instance` (string) A URI reference that identifies the specific occurrence of the error.
  - `errors` (Record<string, string[]>, required) A key-value map of validation errors, where each key represents a request field and the value contains one or more messages describing why the request could not be processed.

## Example (MonoCloud .NET SDK)

```csharp
using MonoCloud.Management;
using MonoCloud.Management.Models;
using MonoCloud.Management.Core.Base;

var apiClient = new MonoCloudManagementClient(new MonoCloudConfig("<your-domain>", "[[API-Key]]"));


var trustStoreId = "9qVBxPQiZqtUsBOykavK6";

var requestBody = new PatchPkiTrustStoreRequest
  {
    Name = "IoT Devices",
    Enabled = true,
    ShowInDiscoveryDocument = true,
    CertChain = "-----BEGIN CERTIFICATE-----certificate_value_1-----END CERTIFICATE-----\n-----BEGIN CERTIFICATE-----certificate_value_2-----END CERTIFICATE-----",
    Options = new PatchPkiTrustStoreOptionsRequest
    {
      ValidateCertificateUse = true,
      ValidateValidityPeriod = true,
      RevocationMode = X509RevocationMode.Offline,
      RevocationCheckDepth = RevocationCheckDepth.EndCertificateOnly,
      RevocationCheckClockSkew = 300,
      OcspCheckTimeout = 10,
      OnlineCrlCheckTimeout = 10,
      CertificateAuthCacheDuration = 300,
      OcspCacheDuration = 1800,
      OnlineCrlCacheDuration = 1800,
    },
  };


var result = await apiClient.TrustStores.PatchPkiTrustStoreAsync(trustStoreId, requestBody);
```

## Example (MonoCloud Javascript SDK)

```javascript
import { MonoCloudManagementClient } from '@monocloud/management';

const apiClient = MonoCloudManagementClient.init({ domain: '<your-domain>', apiKey: '[[API-Key]]' });

const trustStoreId = '9qVBxPQiZqtUsBOykavK6';

const requestBody = {
  name: 'IoT Devices',
  enabled: true,
  show_in_discovery_document: true,
  cert_chain: '-----BEGIN CERTIFICATE-----certificate_value_1-----END CERTIFICATE-----\n-----BEGIN CERTIFICATE-----certificate_value_2-----END CERTIFICATE-----',
  options: {
    validate_certificate_use: true,
    validate_validity_period: true,
    revocation_mode: 'offline',
    revocation_check_depth: 'end_certificate_only',
    revocation_check_clock_skew: 300,
    ocsp_check_timeout: 10,
    online_crl_check_timeout: 10,
    certificate_auth_cache_duration: 300,
    ocsp_cache_duration: 1800,
    online_crl_cache_duration: 1800
  }
};

const result = apiClient.trustStores.patchPkiTrustStore(trustStoreId, requestBody);
```