> ## Documentation Index
> Fetch the complete documentation index at: https://docs.basaltic.sh/llms.txt
> Use this file to discover all available pages before exploring further.

# Update a listener

<Info>
  Requires the IAM action **`loadbalancer:UpdateListener`**. See [LOADBALANCER permissions](/loadbalancer/permissions) for the full list, what each one covers, and an example policy.
</Info>


## OpenAPI

````yaml /api-reference/specs/loadbalancer.yaml patch /v1/load-balancers/{id}/listeners/{listener_id}
openapi: 3.0.3
info:
  title: Basaltic Load Balancer API
  version: 1.0.0
  description: >
    Request relationships accept syntax-classified references resolved within
    the caller account and region.

    Floating IP references accept UUID or CRN only; IP targets stay literal.

    Managed load balancers: listeners, target pools, health checks and the

    TLS certificates a listener terminates.
  contact:
    name: Basaltic Support
    email: ping@basaltic.sh
  license:
    name: Proprietary
    url: https://basaltic.sh/terms
servers:
  - url: https://loadbalancer.{region}.basaltic.sh
    description: Regional API endpoint
    variables:
      region:
        default: sa-saopaulo-1
        description: Region code
security:
  - BearerAuth: []
paths:
  /v1/load-balancers/{id}/listeners/{listener_id}:
    patch:
      tags:
        - Load Balancers
      summary: Update a listener
      operationId: updateListener
      parameters:
        - name: id
          in: path
          required: true
          schema:
            type: string
            example: 4e1f8c2a-9b3d-4f6e-8a1c-2d5e7f9a0b3c
        - name: listener_id
          in: path
          required: true
          schema:
            type: string
            example: e1f2a3b4-c5d6-4789-e0f1-a2b3c4d5e6f7
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/UpdateListenerRequest'
      responses:
        '200':
          description: OK
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ListenerResponse'
        '400':
          $ref: '#/components/responses/BadRequest'
        '401':
          $ref: '#/components/responses/Unauthorized'
        '403':
          $ref: '#/components/responses/Forbidden'
        '404':
          $ref: '#/components/responses/NotFound'
        '500':
          $ref: '#/components/responses/InternalServerError'
components:
  schemas:
    UpdateListenerRequest:
      additionalProperties: false
      type: object
      description: >
        Patch a listener. Use default_certificate to select an already attached

        certificate as the default. Certificate renewals are picked up
        automatically;

        manage attachments through the listener's certificates collection.


        Omit default_target_group to leave it unchanged, send a string reference
        to

        replace it, or send null to clear it.
      properties:
        default_target_group:
          type: string
          nullable: true
          minLength: 1
          description: >-
            UUID, CRN or exact account-scoped target group name. Null clears the
            default; omission leaves it unchanged.
          example: b8c9d0e1-f2a3-4456-b7c8-d9e0f1a2b3c4
        exposure:
          type: string
          enum:
            - public_only
            - private_only
            - both
          example: both
          description: |
            Mutate which addresses are bound. Omit to leave unchanged.
        tags:
          $ref: '#/components/schemas/Tags'
        default_certificate:
          type: string
          minLength: 1
          description: >-
            UUID, CRN, or exact name of a certificate already attached to this
            listener. Makes it the default and demotes the previous default
            atomically. Does not attach new certificates.
          example: prod-web
    ListenerResponse:
      type: object
      properties:
        listener:
          $ref: '#/components/schemas/Listener'
      required:
        - listener
    Tags:
      type: object
      additionalProperties:
        type: string
      example:
        environment: production
        team: backend
    Listener:
      type: object
      required:
        - crn
        - id
        - protocol
        - port
        - exposure
        - tags
        - created_at
        - updated_at
        - default_certificate
        - default_target_group
      properties:
        crn:
          type: string
          description: >-
            Parent-scoped CRN with immutable load balancer name and child UUID
            components.
        id:
          type: string
          format: uuid
          example: e1f2a3b4-c5d6-4789-e0f1-a2b3c4d5e6f7
        protocol:
          type: string
          enum:
            - http
            - https
            - tcp
            - udp
          example: https
        port:
          type: integer
          minimum: 1
          maximum: 65535
          example: 443
        exposure:
          type: string
          enum:
            - public_only
            - private_only
            - both
          example: both
          description: |
            Which LB addresses this listener binds. 'public_only'
            and 'both' require the LB to carry a floating IP; if the FIP
            is detached later, the listener is dropped until a
            FIP is re-attached or exposure is flipped to private_only.
        tags:
          $ref: '#/components/schemas/Tags'
        created_at:
          type: string
          format: date-time
          example: '2026-01-15T09:30:00Z'
        updated_at:
          type: string
          format: date-time
          example: '2026-01-15T09:30:00Z'
        default_certificate:
          anyOf:
            - $ref: '#/components/schemas/ResourceRef'
            - type: object
              nullable: true
              enum:
                - null
          description: >-
            Default certificate for an HTTPS listener, used when no SNI matches
            or the client sends none. Null when absent. List all attached
            certificates through the listener certificates endpoint.
          example:
            id: 550e8400-e29b-41d4-a716-446655440012
            crn: crn:certificate::my-account:certificate/prod-web
            name: prod-web
        default_target_group:
          anyOf:
            - $ref: '#/components/schemas/ResourceRef'
            - type: object
              nullable: true
              enum:
                - null
          description: >-
            Target group used when no routing rule matches, or null when none is
            configured.
          example:
            id: 550e8400-e29b-41d4-a716-446655440013
            crn: crn:loadbalancer:sa-saopaulo-1:my-account:target-group/web
            name: web
    Error:
      type: object
      required:
        - error
      properties:
        error:
          type: object
          required:
            - code
            - message
            - request_id
          properties:
            code:
              type: string
              description: Error code identifying the type of error
              example: INVALID_INPUT
            message:
              type: string
              description: Human-readable error message
              example: Invalid request parameters
            params:
              type: object
              additionalProperties: true
              description: >-
                Optional non-sensitive values for interpolation of localized
                errors, keyed by error code. Never present for server errors.
              example:
                instances: 2
                pools: 0
            request_id:
              type: string
              format: uuid
              description: Request ID for debugging
              example: 550e8400-e29b-41d4-a716-446655440000
    ResourceRef:
      type: object
      required:
        - id
        - crn
      properties:
        id:
          type: string
          format: uuid
          example: 288aa1e9-bbf5-5584-bce9-6a688f06d8a1
        crn:
          type: string
          example: crn:catalog::platform:country/288aa1e9-bbf5-5584-bce9-6a688f06d8a1
        name:
          type: string
          description: >-
            Display label at response time — the resource's name where it has
            one, otherwise its human label (an invoice number, an account
            display name). Absent when the target is gone. Not a lookup key.
          example: Brazil
  responses:
    BadRequest:
      description: Invalid request parameters
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/Error'
          example:
            error:
              code: INVALID_INPUT
              message: Invalid request parameters
              request_id: 550e8400-e29b-41d4-a716-446655440000
    Unauthorized:
      description: Authentication required or token invalid
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/Error'
          example:
            error:
              code: UNAUTHORIZED
              message: Authentication required
              request_id: 550e8400-e29b-41d4-a716-446655440000
    Forbidden:
      description: Insufficient permissions
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/Error'
          example:
            error:
              code: ACCESS_DENIED
              message: You don't have permission to perform this action
              request_id: 550e8400-e29b-41d4-a716-446655440000
    NotFound:
      description: Resource not found
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/Error'
          example:
            error:
              code: NOT_FOUND
              message: Resource not found
              request_id: 550e8400-e29b-41d4-a716-446655440000
    InternalServerError:
      description: Internal server error
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/Error'
          example:
            error:
              code: INTERNAL_ERROR
              message: An internal error occurred
              request_id: 550e8400-e29b-41d4-a716-446655440000
  securitySchemes:
    BearerAuth:
      type: http
      scheme: bearer
      bearerFormat: JWT
      description: |
        An OAuth 2.0 bearer token, sent as `Authorization: Bearer <token>`.
        This is the recommended way to authenticate.

        Get one by exchanging a service account's access key pair at
        `POST /v1/oauth/token` with `grant_type=client_credentials`. It is the
        standard client-credentials grant, so any OAuth-aware library will
        obtain and refresh it for you.

        ```
        curl -s -u "$KEY_ID:$SECRET" -d grant_type=client_credentials \
          https://iam.basaltic.sh/v1/oauth/token
        ```

        Tokens last an hour by default. The same access key pair is separately
        your AWS SigV4 credential for the S3-compatible object endpoint, which
        speaks nothing else.

````

This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.