Issue with updating credentials via Public API (Contradictory "allowedDomains" errors)

Questions
1

Has anyone in the community found a consistent JSON body or workaround to update credentials that require allowedDomains via the API—especially when we want to keep the “Allowed HTTP Request Domains” setting as “ALL”?
Any advice or working examples would be greatly appreciated!

Describe the problem/error/question

I am trying to update credential values (specifically for Header Auth) using the n8n Public API (PATCH /api/v1/credentials/{id}).
However, I am facing contradictory schema validation errors regarding the allowedDomains property. Even after contacting support and being told this is a “known issue,” I haven’t found a stable way to achieve this when the credential is set to “Allow All Domains.”

Share the output returned by the last node

Attempt 1: Including allowedDomains as an empty string
JSON
{
“data”: { “value”: “XXXXXX”, “allowedDomains”: “” },
“isPartialData”: true
}
Error: request.body.data is not allowed to have the additional property “allowedDomains”
Attempt 2: Omitting allowedDomains
Error: request.body.data requires property “allowedDomains”
Attempt 3: Using an empty array (suggested by Support)
While this occasionally works, it remains unstable and inconsistent.

Information on your n8n setup

  • **n8n version:**2.17.5
  • **Database (default: SQLite):**n8n Cloud (Standard)
  • **n8n EXECUTIONS_PROCESS setting (default: own, main):**default
  • **Running n8n via (Docker, npm, n8n cloud, desktop app):**n8n cloud
  • **Operating system:**n8n cloud
3

Hi @Toshio , welcome !

I think this is a bug ! I’d recommend filing a GitHub issue with your three attempts documented so there’s a public, trackable report.

As a workaround until this is fixed: have you tried passing allowedDomains as "*" or as ["*"]? Some credential types accept a wildcard string to represent “all domains”. If support said empty array [] works intermittently, the wildcard might be more stable. Also worth checking the schema definition for your credential type at GET /api/v1/credentials/schema/httpHeaderAuth to see exactly what the API expects.

Let me know :crossed_fingers: