# Replace Cloudflare account credential

> Moves a linked account to another credential, e.g.

Source: https://docs.vigilbase.com/one/api/reference/customers/put-customers-id-cloudflare-accounts-credential

`PUT https://one.vigilbase.com/api/customers/{id}/cloudflare/accounts/credential`

Moves a linked account to another credential, e.g. to rotate a partner key (docs/security/cloudflare-account-credentials.md). A partner can only move an account that already uses a partner credential onto another of its own; only Vigilbase staff can move an account onto or off Vigilbase's key.

## Authorizations

Send one of these:

- `Authorization` (string, header, required): Bearer access token from Vigilbase Identity (`auth.vigilbase.com`), sent as `Authorization: Bearer <token>`. The CLI gets one with `vigilbase login`.
- `Authorization` (string, header, required): Organisation API key (`vb_one_…`) from **Settings → API keys** in Vigilbase One, sent as `Authorization: Bearer vb_one_…`. Needs a key with write access: read-only keys get `403` with the code `read_only_key`. See [organisation API keys](https://docs.vigilbase.com/one/api#organisation-api-keys).
- Permissions checked: `write:customers`, `write:partner_services`

## Path parameters

- `id` (string, required)

## Body (application/json)

- `operationId` (string, required)
- `account_id` (string, required): Min length 1, max length 128.
- `credential` (any, required)

## Responses

### 200

Success

### 401

Authentication required

### 403

Not permitted

## Example request

```bash
# Token from `vigilbase login`, or a write API key (vb_one_…)
curl --request PUT \
  --url 'https://one.vigilbase.com/api/customers/{id}/cloudflare/accounts/credential' \
  --header "Authorization: Bearer $VIGILBASE_TOKEN" \
  --header 'Content-Type: application/json' \
  --data '{"operationId":"<uuid>","account_id":"<string>","credential":"<any>"}'
```