> ## Documentation Index
> Fetch the complete documentation index at: https://docs.mountthor.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Update Principal

> Updates mutable principal metadata, scopes, TTL, matching constraints, and
lifecycle status. Disabling a principal blocks new token exchanges; already
minted sessions keep their own expiry.



## OpenAPI

````yaml /api-reference/customer-api.v1.openapi.json patch /v1/admin/identity/principals/{id}
openapi: 3.1.0
info:
  title: Mount Thor Customer API
  version: v1
servers:
  - description: Mount Thor customer API edge
    url: https://api.mountthor.com
security: []
paths:
  /v1/admin/identity/principals/{id}:
    patch:
      tags:
        - identity-workload
      summary: Update Principal
      description: >-
        Updates mutable principal metadata, scopes, TTL, matching constraints,
        and

        lifecycle status. Disabling a principal blocks new token exchanges;
        already

        minted sessions keep their own expiry.
      operationId: patch_workload_principal
      parameters:
        - description: Principal UUID
          in: path
          name: id
          required: true
          schema:
            format: uuid
            type: string
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/WorkloadPrincipalPatchRequest'
        required: true
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/WorkloadPrincipalResponse'
          description: Principal updated
        '400':
          description: Request body failed validation
        '401':
          description: Missing or invalid customer API key
        '403':
          description: API key is missing principals:write scope
        '404':
          description: Principal does not exist for this customer
        '429':
          content:
            text/plain:
              schema:
                type: string
          description: Rate limit exceeded
          headers:
            Retry-After:
              description: Seconds before retry.
              schema:
                minimum: 1
                type: integer
      security:
        - api_key_bearer:
            - principals:write
components:
  schemas:
    WorkloadPrincipalPatchRequest:
      additionalProperties: false
      description: Request body for `PATCH /v1/admin/identity/principals/{id}`.
      properties:
        display_name:
          description: New customer-facing label.
          maxLength: 200
          type:
            - string
            - 'null'
        max_session_ttl_seconds:
          description: Replacement maximum session TTL in seconds.
          example: 900
          format: int64
          type:
            - integer
            - 'null'
        scopes:
          description: Replacement scopes granted to newly minted sessions.
          example:
            - compute:read
            - compute:write
          items:
            type: string
          type:
            - array
            - 'null'
        status:
          description: 'New lifecycle state: `active` or `disabled`.'
          example: disabled
          type:
            - string
            - 'null'
      type: object
    WorkloadPrincipalResponse:
      allOf:
        - $ref: '#/components/schemas/WorkloadPrincipalMetadata'
        - additionalProperties: false
          properties:
            customer_id:
              description: Stable UUID for the customer account.
              type: string
          required:
            - customer_id
          type: object
      description: Principal detail response.
    WorkloadPrincipalMetadata:
      additionalProperties: false
      description: Principal metadata.
      properties:
        claim_constraints:
          description: >-
            Additional claim constraints used when `subject_match_type` is
            `claim-constraints`.
          type: object
        created_at:
          description: RFC 3339 creation timestamp.
          example: '2026-05-25T17:20:00Z'
          type: string
        display_name:
          description: Customer-facing principal label.
          example: ci-prod-deploy
          type: string
        id:
          description: Stable principal UUID.
          type: string
        max_session_ttl_seconds:
          example: 900
          format: int64
          type: integer
        scopes:
          example:
            - compute:read
            - compute:write
          items:
            type: string
          type: array
        status:
          description: Principal lifecycle state. Disabled principals cannot mint sessions.
          example: active
          type: string
        subject_match_type:
          description: 'Subject matching mode: `exact` or `claim-constraints`.'
          example: exact
          type: string
        subject_match_value:
          description: Required subject value or descriptor for the claim constraint.
          example: repo:Mount-Thor/mount-thor:ref:refs/heads/main
          type: string
        tenant_id:
          type: string
        trusted_issuer_id:
          type: string
        updated_at:
          description: RFC 3339 update timestamp.
          example: '2026-05-25T17:30:00Z'
          type: string
      required:
        - id
        - tenant_id
        - trusted_issuer_id
        - display_name
        - subject_match_type
        - subject_match_value
        - claim_constraints
        - scopes
        - max_session_ttl_seconds
        - status
        - created_at
        - updated_at
      type: object
  securitySchemes:
    api_key_bearer:
      bearerFormat: mthr_live_*
      description: Bearer scheme name used by typed customer admin operations.
      scheme: bearer
      type: http

````