Create or update the user-level config for an Identity under the specified Template.
HTTP 200 OK
Request Headers
| Header | Required | Description |
|---|---|---|
| Authorization | Yes | Bearer <PAT> |
| Content-Type | Yes | application/json |
| Idempotency-Key | No | Optional idempotency key for requests with side effects. |
Path parameters
| Parameter | Type | Required | Description |
|---|---|---|---|
identity_id | string | Yes | Forward Identity ID. |
template_id | string | Yes | Forward Template ID. |
Request body
| Parameter | Type | Required | Description |
|---|---|---|---|
name | string | No | Config display name. |
identity_config | object | Yes | User-level override configuration. |
metadata | object | No | Business metadata; when provided, fully replaces existing metadata. |
Identity Config object
identity_config is the stored user-level override DSL, not the compiled runtime config returned by Get Effective Config.
| Field | Internal category | Description |
|---|---|---|
system | Agent | System prompt override or append rules. |
model | Agent | Model override. |
tools | Agent | Built-in tool overrides, organized by tool name. |
mcp_servers | Agent | MCP Server overrides, organized by MCP server name. |
skills | Agent | Skill overrides, organized by Skill ID. |
toolsets | Agent | Toolset-level overrides, mainly for MCP toolsets or built-in tool groups. |
agent_metadata | Agent | Merged into the compiled Agent metadata. |
vaults | Session | Vault resource overrides, organized by Vault ID. |
files | Session | File resource overrides, organized by File ID; mount_path is injected by Forward and callers do not need to provide it. |
environment / environment_id | Not supported | Identity Config cannot override the Template's execution environment; passing these fields returns 400 invalid_request_error. |
Update semantics
| Request form | Semantics |
|---|---|
| Field absent | Keep the existing value. |
Field present with non-null value | Update this field. |
Field present with value null | Remove this field from the current Identity Config. |
metadata absent | Keep the existing metadata. |
metadata is an object | Fully replace the existing metadata. |
metadata is null | Clear metadata. |
Resource map semantics
skills, vaults, and files use the resource ID as the map key. Do not write skill_id, vault_id, file_id, id, or resource_id inside the entries; these runtime fields only appear in the Forward-compiled Effective Config.
| Map entry value | Semantics |
|---|---|
{ "enabled": true } | Explicitly enable or override this resource. |
{ "enabled": false } | Explicitly disable this resource; even if present in the Template baseline it is removed or masked. |
| Entry absent | Inherit the Template baseline. |
Entry value null | Remove the current override and restore inheritance from the Template baseline. |
Example request
Example response
HTTP 200 OK
Response Fields
| Field | Type | Description |
|---|---|---|
type | string | Always config. |
identity_id | string | Forward Identity ID. |
template_id | string | Forward Template ID. |
effective_hash | string | Hash of the compiled Effective Config. |
Errors
| HTTP | Type | Code | Trigger |
|---|---|---|---|
| 400 | invalid_request_error | - | Invalid config field, unsupported Environment override, or invalid body. |
| 404 | not_found_error | - | Identity, Template, Skill, Vault, or File does not exist. |
| 409 | conflict_error | - | Config state conflict. |
| 401 | authentication_error | authentication_required | PAT invalid or expired. |
Notes
- Omitted fields remain unchanged.
- Passing a field as
nullremoves it from the current Identity Config. - Resource maps use the resource ID as the key; setting a resource entry to
nullrestores inheritance. - Identity Config currently does not support overriding
environment_id.