curl --request PATCH \
--url https://compute.{region}.basaltic.sh/v1/instances/{instance_id} \
--header 'Authorization: Bearer <token>' \
--header 'Content-Type: application/json' \
--data '
{
"iam_role": "workload-role",
"description": "Primary web server",
"metadata": {
"environment": "production",
"team": "backend"
},
"tags": {
"environment": "production",
"team": "backend"
}
}
'import requests
url = "https://compute.{region}.basaltic.sh/v1/instances/{instance_id}"
payload = {
"iam_role": "workload-role",
"description": "Primary web server",
"metadata": {
"environment": "production",
"team": "backend"
},
"tags": {
"environment": "production",
"team": "backend"
}
}
headers = {
"Authorization": "Bearer <token>",
"Content-Type": "application/json"
}
response = requests.patch(url, json=payload, headers=headers)
print(response.text)const options = {
method: 'PATCH',
headers: {Authorization: 'Bearer <token>', 'Content-Type': 'application/json'},
body: JSON.stringify({
iam_role: 'workload-role',
description: 'Primary web server',
metadata: {environment: 'production', team: 'backend'},
tags: {environment: 'production', team: 'backend'}
})
};
fetch('https://compute.{region}.basaltic.sh/v1/instances/{instance_id}', options)
.then(res => res.json())
.then(res => console.log(res))
.catch(err => console.error(err));<?php
$curl = curl_init();
curl_setopt_array($curl, [
CURLOPT_URL => "https://compute.{region}.basaltic.sh/v1/instances/{instance_id}",
CURLOPT_RETURNTRANSFER => true,
CURLOPT_ENCODING => "",
CURLOPT_MAXREDIRS => 10,
CURLOPT_TIMEOUT => 30,
CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
CURLOPT_CUSTOMREQUEST => "PATCH",
CURLOPT_POSTFIELDS => json_encode([
'iam_role' => 'workload-role',
'description' => 'Primary web server',
'metadata' => [
'environment' => 'production',
'team' => 'backend'
],
'tags' => [
'environment' => 'production',
'team' => 'backend'
]
]),
CURLOPT_HTTPHEADER => [
"Authorization: Bearer <token>",
"Content-Type: application/json"
],
]);
$response = curl_exec($curl);
$err = curl_error($curl);
curl_close($curl);
if ($err) {
echo "cURL Error #:" . $err;
} else {
echo $response;
}package main
import (
"fmt"
"strings"
"net/http"
"io"
)
func main() {
url := "https://compute.{region}.basaltic.sh/v1/instances/{instance_id}"
payload := strings.NewReader("{\n \"iam_role\": \"workload-role\",\n \"description\": \"Primary web server\",\n \"metadata\": {\n \"environment\": \"production\",\n \"team\": \"backend\"\n },\n \"tags\": {\n \"environment\": \"production\",\n \"team\": \"backend\"\n }\n}")
req, _ := http.NewRequest("PATCH", url, payload)
req.Header.Add("Authorization", "Bearer <token>")
req.Header.Add("Content-Type", "application/json")
res, _ := http.DefaultClient.Do(req)
defer res.Body.Close()
body, _ := io.ReadAll(res.Body)
fmt.Println(string(body))
}HttpResponse<String> response = Unirest.patch("https://compute.{region}.basaltic.sh/v1/instances/{instance_id}")
.header("Authorization", "Bearer <token>")
.header("Content-Type", "application/json")
.body("{\n \"iam_role\": \"workload-role\",\n \"description\": \"Primary web server\",\n \"metadata\": {\n \"environment\": \"production\",\n \"team\": \"backend\"\n },\n \"tags\": {\n \"environment\": \"production\",\n \"team\": \"backend\"\n }\n}")
.asString();require 'uri'
require 'net/http'
url = URI("https://compute.{region}.basaltic.sh/v1/instances/{instance_id}")
http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true
request = Net::HTTP::Patch.new(url)
request["Authorization"] = 'Bearer <token>'
request["Content-Type"] = 'application/json'
request.body = "{\n \"iam_role\": \"workload-role\",\n \"description\": \"Primary web server\",\n \"metadata\": {\n \"environment\": \"production\",\n \"team\": \"backend\"\n },\n \"tags\": {\n \"environment\": \"production\",\n \"team\": \"backend\"\n }\n}"
response = http.request(request)
puts response.read_body{
"instance": {
"id": "550e8400-e29b-41d4-a716-446655440000",
"crn": "crn:compute:sa-saopaulo-1:my-account:instance/web-01",
"name": "web-server-01",
"flavor": {
"id": "550e8400-e29b-41d4-a716-446655440003",
"crn": "crn:compute:sa-saopaulo-1:platform:flavor/s1.small",
"name": "s1.small"
},
"image": {
"id": "550e8400-e29b-41d4-a716-446655440004",
"crn": "crn:compute:sa-saopaulo-1:platform:image/ubuntu/architecture/amd64/version/24.04",
"name": "ubuntu"
},
"iam_role": {
"id": "550e8400-e29b-41d4-a716-446655440005",
"crn": "crn:iam:::role/550e8400-e29b-41d4-a716-446655440005",
"name": "instance-role"
},
"faults": [
{
"code": "BACKUP_FAILED",
"severity": "error",
"message": "Backup upload failed.",
"details": {},
"first_at": "2023-11-07T05:31:56Z",
"last_at": "2023-11-07T05:31:56Z",
"occurrences": 1
}
],
"created_at": "2024-01-15T10:30:00Z",
"updated_at": "2024-01-15T10:30:00Z",
"desired_state": "running",
"current_state": "running",
"description": "Primary web server",
"task_state": null,
"user_data": "<string>",
"metadata": {
"environment": "production",
"team": "backend"
},
"tags": {
"environment": "production",
"team": "backend"
},
"launched_at": "2026-01-15T09:31:12Z",
"terminated_at": null
}
}{
"error": {
"code": "INVALID_INPUT",
"message": "Invalid request parameters",
"request_id": "550e8400-e29b-41d4-a716-446655440000"
}
}{
"error": {
"code": "UNAUTHORIZED",
"message": "Authentication required",
"request_id": "550e8400-e29b-41d4-a716-446655440000"
}
}{
"error": {
"code": "ACCESS_DENIED",
"message": "You don't have permission to perform this action",
"request_id": "550e8400-e29b-41d4-a716-446655440000"
}
}{
"error": {
"code": "NOT_FOUND",
"message": "Resource not found",
"request_id": "550e8400-e29b-41d4-a716-446655440000"
}
}{
"error": {
"code": "CONFLICT",
"message": "Resource with this name already exists",
"request_id": "550e8400-e29b-41d4-a716-446655440000"
}
}{
"error": {
"code": "INTERNAL_ERROR",
"message": "An internal error occurred",
"request_id": "550e8400-e29b-41d4-a716-446655440000"
}
}Update instance
Update an instance’s description, metadata, tags, or workload IAM role. Its name is immutable. Role replacement is atomic and needs no restart. Omit iam_role to preserve it; send an empty string to detach. Concurrent edits serialize in commit order, and repeating the current association is a no-op. Existing STS credentials keep their expiry (up to one hour).
curl --request PATCH \
--url https://compute.{region}.basaltic.sh/v1/instances/{instance_id} \
--header 'Authorization: Bearer <token>' \
--header 'Content-Type: application/json' \
--data '
{
"iam_role": "workload-role",
"description": "Primary web server",
"metadata": {
"environment": "production",
"team": "backend"
},
"tags": {
"environment": "production",
"team": "backend"
}
}
'import requests
url = "https://compute.{region}.basaltic.sh/v1/instances/{instance_id}"
payload = {
"iam_role": "workload-role",
"description": "Primary web server",
"metadata": {
"environment": "production",
"team": "backend"
},
"tags": {
"environment": "production",
"team": "backend"
}
}
headers = {
"Authorization": "Bearer <token>",
"Content-Type": "application/json"
}
response = requests.patch(url, json=payload, headers=headers)
print(response.text)const options = {
method: 'PATCH',
headers: {Authorization: 'Bearer <token>', 'Content-Type': 'application/json'},
body: JSON.stringify({
iam_role: 'workload-role',
description: 'Primary web server',
metadata: {environment: 'production', team: 'backend'},
tags: {environment: 'production', team: 'backend'}
})
};
fetch('https://compute.{region}.basaltic.sh/v1/instances/{instance_id}', options)
.then(res => res.json())
.then(res => console.log(res))
.catch(err => console.error(err));<?php
$curl = curl_init();
curl_setopt_array($curl, [
CURLOPT_URL => "https://compute.{region}.basaltic.sh/v1/instances/{instance_id}",
CURLOPT_RETURNTRANSFER => true,
CURLOPT_ENCODING => "",
CURLOPT_MAXREDIRS => 10,
CURLOPT_TIMEOUT => 30,
CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
CURLOPT_CUSTOMREQUEST => "PATCH",
CURLOPT_POSTFIELDS => json_encode([
'iam_role' => 'workload-role',
'description' => 'Primary web server',
'metadata' => [
'environment' => 'production',
'team' => 'backend'
],
'tags' => [
'environment' => 'production',
'team' => 'backend'
]
]),
CURLOPT_HTTPHEADER => [
"Authorization: Bearer <token>",
"Content-Type: application/json"
],
]);
$response = curl_exec($curl);
$err = curl_error($curl);
curl_close($curl);
if ($err) {
echo "cURL Error #:" . $err;
} else {
echo $response;
}package main
import (
"fmt"
"strings"
"net/http"
"io"
)
func main() {
url := "https://compute.{region}.basaltic.sh/v1/instances/{instance_id}"
payload := strings.NewReader("{\n \"iam_role\": \"workload-role\",\n \"description\": \"Primary web server\",\n \"metadata\": {\n \"environment\": \"production\",\n \"team\": \"backend\"\n },\n \"tags\": {\n \"environment\": \"production\",\n \"team\": \"backend\"\n }\n}")
req, _ := http.NewRequest("PATCH", url, payload)
req.Header.Add("Authorization", "Bearer <token>")
req.Header.Add("Content-Type", "application/json")
res, _ := http.DefaultClient.Do(req)
defer res.Body.Close()
body, _ := io.ReadAll(res.Body)
fmt.Println(string(body))
}HttpResponse<String> response = Unirest.patch("https://compute.{region}.basaltic.sh/v1/instances/{instance_id}")
.header("Authorization", "Bearer <token>")
.header("Content-Type", "application/json")
.body("{\n \"iam_role\": \"workload-role\",\n \"description\": \"Primary web server\",\n \"metadata\": {\n \"environment\": \"production\",\n \"team\": \"backend\"\n },\n \"tags\": {\n \"environment\": \"production\",\n \"team\": \"backend\"\n }\n}")
.asString();require 'uri'
require 'net/http'
url = URI("https://compute.{region}.basaltic.sh/v1/instances/{instance_id}")
http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true
request = Net::HTTP::Patch.new(url)
request["Authorization"] = 'Bearer <token>'
request["Content-Type"] = 'application/json'
request.body = "{\n \"iam_role\": \"workload-role\",\n \"description\": \"Primary web server\",\n \"metadata\": {\n \"environment\": \"production\",\n \"team\": \"backend\"\n },\n \"tags\": {\n \"environment\": \"production\",\n \"team\": \"backend\"\n }\n}"
response = http.request(request)
puts response.read_body{
"instance": {
"id": "550e8400-e29b-41d4-a716-446655440000",
"crn": "crn:compute:sa-saopaulo-1:my-account:instance/web-01",
"name": "web-server-01",
"flavor": {
"id": "550e8400-e29b-41d4-a716-446655440003",
"crn": "crn:compute:sa-saopaulo-1:platform:flavor/s1.small",
"name": "s1.small"
},
"image": {
"id": "550e8400-e29b-41d4-a716-446655440004",
"crn": "crn:compute:sa-saopaulo-1:platform:image/ubuntu/architecture/amd64/version/24.04",
"name": "ubuntu"
},
"iam_role": {
"id": "550e8400-e29b-41d4-a716-446655440005",
"crn": "crn:iam:::role/550e8400-e29b-41d4-a716-446655440005",
"name": "instance-role"
},
"faults": [
{
"code": "BACKUP_FAILED",
"severity": "error",
"message": "Backup upload failed.",
"details": {},
"first_at": "2023-11-07T05:31:56Z",
"last_at": "2023-11-07T05:31:56Z",
"occurrences": 1
}
],
"created_at": "2024-01-15T10:30:00Z",
"updated_at": "2024-01-15T10:30:00Z",
"desired_state": "running",
"current_state": "running",
"description": "Primary web server",
"task_state": null,
"user_data": "<string>",
"metadata": {
"environment": "production",
"team": "backend"
},
"tags": {
"environment": "production",
"team": "backend"
},
"launched_at": "2026-01-15T09:31:12Z",
"terminated_at": null
}
}{
"error": {
"code": "INVALID_INPUT",
"message": "Invalid request parameters",
"request_id": "550e8400-e29b-41d4-a716-446655440000"
}
}{
"error": {
"code": "UNAUTHORIZED",
"message": "Authentication required",
"request_id": "550e8400-e29b-41d4-a716-446655440000"
}
}{
"error": {
"code": "ACCESS_DENIED",
"message": "You don't have permission to perform this action",
"request_id": "550e8400-e29b-41d4-a716-446655440000"
}
}{
"error": {
"code": "NOT_FOUND",
"message": "Resource not found",
"request_id": "550e8400-e29b-41d4-a716-446655440000"
}
}{
"error": {
"code": "CONFLICT",
"message": "Resource with this name already exists",
"request_id": "550e8400-e29b-41d4-a716-446655440000"
}
}{
"error": {
"code": "INTERNAL_ERROR",
"message": "An internal error occurred",
"request_id": "550e8400-e29b-41d4-a716-446655440000"
}
}compute:UpdateInstance. See COMPUTE permissions for the full list, what each one covers, and an example policy.Authorizations
An OAuth 2.0 bearer token, sent as Authorization: Bearer <token>.
This is the recommended way to authenticate.
Get one by exchanging a service account's access key pair at
POST /v1/oauth/token with grant_type=client_credentials. It is the
standard client-credentials grant, so any OAuth-aware library will
obtain and refresh it for you.
curl -s -u "$KEY_ID:$SECRET" -d grant_type=client_credentials \
https://iam.basaltic.sh/v1/oauth/token
Tokens last an hour by default. The same access key pair is separately your AWS SigV4 credential for the S3-compatible object endpoint, which speaks nothing else.
Path Parameters
Instance ID
Body
Attach or replace the instance workload role using its ID, name, or CRN. Omit this field to keep the current role; send an empty string to detach it. Null is not accepted. Requires compute:UpdateInstance; attach/replace also require iam:PassRole and a role trust policy allowing this instance. Only running or stopped customer-managed instances with no operation in progress support role edits. Pool members use the pool launch template. New IMDS requests observe the committed association immediately. Previously issued credentials are not revoked and remain valid until expiry (up to one hour); in-flight requests may complete with their prior association.
"workload-role"
1000"Primary web server"
Show child attributes
Show child attributes
{
"environment": "production",
"team": "backend"
}
Show child attributes
Show child attributes
{
"environment": "production",
"team": "backend"
}
Response
Instance updated
Show child attributes
Show child attributes

