Update database binding API Reference

PATCH

/tenants/{tenant}/databases/{name}/bindings/{binding}

curl --request PATCH \
  --url https://api.kupe.cloud/api/v1/tenants/acme/databases/orders-db/bindings/orders-db-prod-readwrite \
  --header 'Authorization: <Authorization>' \
  --header 'Content-Type: application/json' \
  --header 'If-Match: 582020' \
  --data '{ "namespaces": [ "orders-api", "orders-worker" ] }'

Replace the namespaces a binding delivers into (JSON merge-patch semantics: the list sent is the new list). A namespace added gets the Service and credentials Secret; a namespace left out loses its Secret, and its Service and network path unless another binding of the database lists it. The other namespaces keep working. namespaces is the only field that can change: the cluster, role and secretName are fixed, and sending any of them is a 400.

Authorizations

• BearerAuth

Parameters

Path Parameters

tenant

required

string

Tenant name

name

required

string

Database name

binding

required

string

Binding name

Header Parameters

If-Match

string

ETag for optimistic locking

Request Body

The new namespace list

Media type application/json

object

namespaces

Namespaces replaces the binding’s namespace list, with the same rules as on create: 1 to 10, each listed once, none kube-* or argocd. A namespace added is delivered into; a namespace left out loses its Secret, and its Service and network path unless another binding of the database lists it. The others keep theirs. To add or remove one, read the binding, edit its list and send it back with If-Match set to the ETag read.

Array<string>

Example

[
  "orders-api",
  "orders-worker"
]

Responses

200

Updated binding

Media type application/json

object

cluster

string

createdAt

string

database

string

name

string

namespaces

Namespaces are the namespaces the binding delivers into (1 to 10).

Array<string>

resourceVersion

string

role

string

Allowed values: owner readwrite readonly

secretName

SecretName as requested; empty means the default “{database}-{role}”.

string

status

object

conditions

Array<object>

object

key

additional properties

message

string

namespaces

Namespaces reports what was delivered into each namespace. A namespace removed from namespaces stays here until what was delivered there is withdrawn.

Array<object>

object

deliveredRotation

DeliveredRotation is the rotate-credentials token of the password the credentials Secret in this namespace carries; empty if the role was never rotated.

string

host

Host is the in-cluster DNS name applications in this namespace connect to; empty while nothing is delivered.

string

message

Message gives detail while the namespace is not Ready.

string

name

Name is the namespace inside the cluster.

string

phase

string

Allowed values: Pending Ready Failed

phase

Phase is Ready only when every listed namespace is Ready.

string

Allowed values: Pending Ready Failed

secretName

SecretName is the effective credentials Secret name in every listed namespace.

string

Example

{
  "cluster": "prod",
  "createdAt": "2026-10-09T10:05:00Z",
  "database": "orders-db",
  "name": "orders-db-prod-readwrite",
  "namespaces": [
    "orders-api",
    "orders-worker"
  ],
  "resourceVersion": "582020",
  "role": "owner",
  "secretName": "orders-db-readwrite",
  "status": {
    "message": "",
    "namespaces": [
      {
        "deliveredRotation": "2026-10-09T12:00:00.123456789Z",
        "host": "orders-db.orders-api.svc.cluster.local",
        "message": "",
        "name": "orders-api",
        "phase": "Pending"
      }
    ],
    "phase": "Pending",
    "secretName": "orders-db-readwrite"
  }
}

Headers

ETag

string

New resource version

400

Validation error

Media type application/json

object

code

string

error

string

field

string

message

string

severity

string

Example ^generated

{
  "code": "example",
  "error": "example",
  "field": "example",
  "message": "example",
  "severity": "example"
}

401

Missing or invalid authentication

Media type application/json

object

code

string

error

string

field

string

message

string

severity

string

Example ^generated

{
  "code": "example",
  "error": "example",
  "field": "example",
  "message": "example",
  "severity": "example"
}

403

Admin access required

Media type application/json

object

code

string

error

string

field

string

message

string

severity

string

Example ^generated

{
  "code": "example",
  "error": "example",
  "field": "example",
  "message": "example",
  "severity": "example"
}

404

Binding not found for this database, or databases are switched off and the change adds a namespace (code databases_unavailable)

Media type application/json

object

code

string

error

string

field

string

message

string

severity

string

Example ^generated

{
  "code": "example",
  "error": "example",
  "field": "example",
  "message": "example",
  "severity": "example"
}

409

The binding or its database is being deleted (code terminating), or the binding kept changing while it was being updated

Media type application/json

object

code

string

error

string

field

string

message

string

severity

string

Example ^generated

{
  "code": "example",
  "error": "example",
  "field": "example",
  "message": "example",
  "severity": "example"
}

412

ETag mismatch

Media type application/json

object

code

string

error

string

field

string

message

string

severity

string

Example ^generated

{
  "code": "example",
  "error": "example",
  "field": "example",
  "message": "example",
  "severity": "example"
}

429

Rate limit exceeded

Media type application/json

object

code

string

error

string

field

string

message

string

severity

string

Example ^generated

{
  "code": "example",
  "error": "example",
  "field": "example",
  "message": "example",
  "severity": "example"
}