curl --request PATCH \
--url https://telemetry.{region}.basaltic.sh/v1/trace-settings \
--header 'Authorization: Bearer <token>' \
--header 'Content-Type: application/json' \
--data '
{
"retention_days": 90,
"kms_key": "crn:kms:sa-saopaulo-1:my-account:key/service-key"
}
'import requests
url = "https://telemetry.{region}.basaltic.sh/v1/trace-settings"
payload = {
"retention_days": 90,
"kms_key": "crn:kms:sa-saopaulo-1:my-account:key/service-key"
}
headers = {
"Authorization": "Bearer <token>",
"Content-Type": "application/json"
}
response = requests.patch(url, json=payload, headers=headers)
print(response.text)const options = {
method: 'PATCH',
headers: {Authorization: 'Bearer <token>', 'Content-Type': 'application/json'},
body: JSON.stringify({
retention_days: 90,
kms_key: 'crn:kms:sa-saopaulo-1:my-account:key/service-key'
})
};
fetch('https://telemetry.{region}.basaltic.sh/v1/trace-settings', options)
.then(res => res.json())
.then(res => console.log(res))
.catch(err => console.error(err));<?php
$curl = curl_init();
curl_setopt_array($curl, [
CURLOPT_URL => "https://telemetry.{region}.basaltic.sh/v1/trace-settings",
CURLOPT_RETURNTRANSFER => true,
CURLOPT_ENCODING => "",
CURLOPT_MAXREDIRS => 10,
CURLOPT_TIMEOUT => 30,
CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
CURLOPT_CUSTOMREQUEST => "PATCH",
CURLOPT_POSTFIELDS => json_encode([
'retention_days' => 90,
'kms_key' => 'crn:kms:sa-saopaulo-1:my-account:key/service-key'
]),
CURLOPT_HTTPHEADER => [
"Authorization: Bearer <token>",
"Content-Type: application/json"
],
]);
$response = curl_exec($curl);
$err = curl_error($curl);
curl_close($curl);
if ($err) {
echo "cURL Error #:" . $err;
} else {
echo $response;
}package main
import (
"fmt"
"strings"
"net/http"
"io"
)
func main() {
url := "https://telemetry.{region}.basaltic.sh/v1/trace-settings"
payload := strings.NewReader("{\n \"retention_days\": 90,\n \"kms_key\": \"crn:kms:sa-saopaulo-1:my-account:key/service-key\"\n}")
req, _ := http.NewRequest("PATCH", url, payload)
req.Header.Add("Authorization", "Bearer <token>")
req.Header.Add("Content-Type", "application/json")
res, _ := http.DefaultClient.Do(req)
defer res.Body.Close()
body, _ := io.ReadAll(res.Body)
fmt.Println(string(body))
}HttpResponse<String> response = Unirest.patch("https://telemetry.{region}.basaltic.sh/v1/trace-settings")
.header("Authorization", "Bearer <token>")
.header("Content-Type", "application/json")
.body("{\n \"retention_days\": 90,\n \"kms_key\": \"crn:kms:sa-saopaulo-1:my-account:key/service-key\"\n}")
.asString();require 'uri'
require 'net/http'
url = URI("https://telemetry.{region}.basaltic.sh/v1/trace-settings")
http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true
request = Net::HTTP::Patch.new(url)
request["Authorization"] = 'Bearer <token>'
request["Content-Type"] = 'application/json'
request.body = "{\n \"retention_days\": 90,\n \"kms_key\": \"crn:kms:sa-saopaulo-1:my-account:key/service-key\"\n}"
response = http.request(request)
puts response.read_body{
"trace_settings": {
"retention_days": 30,
"created_at": "2026-01-15T09:30:00Z",
"updated_at": "2026-01-15T09:30:00Z",
"kms_key": {
"id": "288aa1e9-bbf5-5584-bce9-6a688f06d8a1",
"crn": "crn:catalog::platform:country/288aa1e9-bbf5-5584-bce9-6a688f06d8a1",
"name": "Brazil"
}
}
}{
"error": {
"code": "INVALID_INPUT",
"message": "Invalid request parameters",
"request_id": "550e8400-e29b-41d4-a716-446655440000"
}
}{
"error": {
"code": "UNAUTHORIZED",
"message": "Authentication required",
"request_id": "550e8400-e29b-41d4-a716-446655440000"
}
}{
"error": {
"code": "ACCESS_DENIED",
"message": "You don't have permission to perform this action",
"request_id": "550e8400-e29b-41d4-a716-446655440000"
}
}{
"error": {
"code": "INTERNAL_ERROR",
"message": "An internal error occurred",
"request_id": "550e8400-e29b-41d4-a716-446655440000"
}
}Update the caller account's trace settings
Updates supplied fields only. Null retention restores 30 days; null kms_key clears encryption for future spans. Stored spans keep their original retention and encryption. Requires telemetry:PutTraceSettings.
curl --request PATCH \
--url https://telemetry.{region}.basaltic.sh/v1/trace-settings \
--header 'Authorization: Bearer <token>' \
--header 'Content-Type: application/json' \
--data '
{
"retention_days": 90,
"kms_key": "crn:kms:sa-saopaulo-1:my-account:key/service-key"
}
'import requests
url = "https://telemetry.{region}.basaltic.sh/v1/trace-settings"
payload = {
"retention_days": 90,
"kms_key": "crn:kms:sa-saopaulo-1:my-account:key/service-key"
}
headers = {
"Authorization": "Bearer <token>",
"Content-Type": "application/json"
}
response = requests.patch(url, json=payload, headers=headers)
print(response.text)const options = {
method: 'PATCH',
headers: {Authorization: 'Bearer <token>', 'Content-Type': 'application/json'},
body: JSON.stringify({
retention_days: 90,
kms_key: 'crn:kms:sa-saopaulo-1:my-account:key/service-key'
})
};
fetch('https://telemetry.{region}.basaltic.sh/v1/trace-settings', options)
.then(res => res.json())
.then(res => console.log(res))
.catch(err => console.error(err));<?php
$curl = curl_init();
curl_setopt_array($curl, [
CURLOPT_URL => "https://telemetry.{region}.basaltic.sh/v1/trace-settings",
CURLOPT_RETURNTRANSFER => true,
CURLOPT_ENCODING => "",
CURLOPT_MAXREDIRS => 10,
CURLOPT_TIMEOUT => 30,
CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
CURLOPT_CUSTOMREQUEST => "PATCH",
CURLOPT_POSTFIELDS => json_encode([
'retention_days' => 90,
'kms_key' => 'crn:kms:sa-saopaulo-1:my-account:key/service-key'
]),
CURLOPT_HTTPHEADER => [
"Authorization: Bearer <token>",
"Content-Type: application/json"
],
]);
$response = curl_exec($curl);
$err = curl_error($curl);
curl_close($curl);
if ($err) {
echo "cURL Error #:" . $err;
} else {
echo $response;
}package main
import (
"fmt"
"strings"
"net/http"
"io"
)
func main() {
url := "https://telemetry.{region}.basaltic.sh/v1/trace-settings"
payload := strings.NewReader("{\n \"retention_days\": 90,\n \"kms_key\": \"crn:kms:sa-saopaulo-1:my-account:key/service-key\"\n}")
req, _ := http.NewRequest("PATCH", url, payload)
req.Header.Add("Authorization", "Bearer <token>")
req.Header.Add("Content-Type", "application/json")
res, _ := http.DefaultClient.Do(req)
defer res.Body.Close()
body, _ := io.ReadAll(res.Body)
fmt.Println(string(body))
}HttpResponse<String> response = Unirest.patch("https://telemetry.{region}.basaltic.sh/v1/trace-settings")
.header("Authorization", "Bearer <token>")
.header("Content-Type", "application/json")
.body("{\n \"retention_days\": 90,\n \"kms_key\": \"crn:kms:sa-saopaulo-1:my-account:key/service-key\"\n}")
.asString();require 'uri'
require 'net/http'
url = URI("https://telemetry.{region}.basaltic.sh/v1/trace-settings")
http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true
request = Net::HTTP::Patch.new(url)
request["Authorization"] = 'Bearer <token>'
request["Content-Type"] = 'application/json'
request.body = "{\n \"retention_days\": 90,\n \"kms_key\": \"crn:kms:sa-saopaulo-1:my-account:key/service-key\"\n}"
response = http.request(request)
puts response.read_body{
"trace_settings": {
"retention_days": 30,
"created_at": "2026-01-15T09:30:00Z",
"updated_at": "2026-01-15T09:30:00Z",
"kms_key": {
"id": "288aa1e9-bbf5-5584-bce9-6a688f06d8a1",
"crn": "crn:catalog::platform:country/288aa1e9-bbf5-5584-bce9-6a688f06d8a1",
"name": "Brazil"
}
}
}{
"error": {
"code": "INVALID_INPUT",
"message": "Invalid request parameters",
"request_id": "550e8400-e29b-41d4-a716-446655440000"
}
}{
"error": {
"code": "UNAUTHORIZED",
"message": "Authentication required",
"request_id": "550e8400-e29b-41d4-a716-446655440000"
}
}{
"error": {
"code": "ACCESS_DENIED",
"message": "You don't have permission to perform this action",
"request_id": "550e8400-e29b-41d4-a716-446655440000"
}
}{
"error": {
"code": "INTERNAL_ERROR",
"message": "An internal error occurred",
"request_id": "550e8400-e29b-41d4-a716-446655440000"
}
}telemetry:PutTraceSettings. See TELEMETRY permissions for the full list, what each one covers, and an example policy.Authorizations
An OAuth 2.0 bearer token, sent as Authorization: Bearer <token>.
This is the recommended way to authenticate.
Get one by exchanging a service account's access key pair at
POST /v1/oauth/token with grant_type=client_credentials. It is the
standard client-credentials grant, so any OAuth-aware library will
obtain and refresh it for you.
curl -s -u "$KEY_ID:$SECRET" -d grant_type=client_credentials \
https://iam.basaltic.sh/v1/oauth/token
Tokens last an hour by default. The same access key pair is separately your AWS SigV4 credential for the S3-compatible object endpoint, which speaks nothing else.
Body
Omit to preserve retention. Null restores the default 30 days; traces always expire.
1, 3, 5, 7, 14, 30, 60, 90, 120, 150, 180, 365, 400, 545, 731, 1096, 1827, 2192, 2557, 2922, 3288, 3653, null 90
KMS key UUID, CRN or exact name in this account and region. Omit to preserve the binding; null clears encryption for future records.
"crn:kms:sa-saopaulo-1:my-account:key/service-key"
Response
Updated trace settings
Show child attributes
Show child attributes

