Skip to main content

​
updateCvmEnvs

PATCH /cvms/{cvmId}/envs Updates the encrypted environment variables for a running CVM. This function uses a two-phase flow when the set of allowed env keys changes on a CVM with on-chain KMS:
  1. Phase 1: Call with encrypted_env and env_keys. If the env keys changed and the CVM uses on-chain KMS, the API returns precondition_required with a compose_hash.
  2. Register on-chain: Call addComposeHash to register the new compose hash on the blockchain.
  3. Phase 2: Retry the call with the original parameters plus compose_hash and transaction_hash.
Parameters:
FieldTypeRequiredDescription
idstringYesCVM identifier
encrypted_envstringYesHex-encoded encrypted environment variables
env_keysstring[]NoAllowed environment variable keys
compose_hashstringNoCompose hash (Phase 2, after on-chain registration)
transaction_hashstringNoOn-chain transaction hash (Phase 2)
Returns: Union of two possible responses: Success (in_progress):
FieldTypeDescription
status"in_progress"Update accepted
messagestringStatus message
correlation_idstringTracking ID
allowed_envs_changedbooleanWhether env keys changed
Precondition required (precondition_required):
FieldTypeDescription
status"precondition_required"On-chain registration needed
messagestringInstructions
compose_hashstringHash to register on-chain
app_idstringApp ID for contract interaction
device_idstringDevice ID
kms_infoKmsInfoKMS details for chain interaction
Example — PHALA KMS (single phase): 
import { encryptEnvVars, parseEnvVars } from "@phala/cloud";

const envVars = parseEnvVars("API_KEY=secret\nDB_URL=postgres://...");
const pubkey = cvm.encrypted_env_pubkey;
const encrypted = await encryptEnvVars(envVars, pubkey);

const result = await client.updateCvmEnvs({
  id: "my-app",
  encrypted_env: encrypted,
  env_keys: ["API_KEY", "DB_URL"],
});
// result.status === "in_progress"
Example — On-chain KMS (two phases): 
// Phase 1: attempt update
const result = await client.updateCvmEnvs({
  id: "my-app",
  encrypted_env: encrypted,
  env_keys: ["API_KEY", "NEW_VAR"],
});

if (result.status === "precondition_required") {
  // Register compose hash on-chain
  const receipt = await addComposeHash({
    chain: result.kms_info.chain,
    kmsContractAddress: result.kms_info.kms_contract_address,
    appId: result.app_id as `0x${string}`,
    composeHash: result.compose_hash,
    privateKey: privateKey,
  });

  // Phase 2: retry with transaction proof
  await client.updateCvmEnvs({
    id: "my-app",
    encrypted_env: encrypted,
    env_keys: ["API_KEY", "NEW_VAR"],
    compose_hash: result.compose_hash,
    transaction_hash: receipt.transactionHash,
  });
}

​
safeUpdateCvmEnvs

Safe variant that returns a SafeResult instead of throwing on errors.