Update an API key

OpenAPI contract

Method

PUT

Path

/api/v1/api-keys/{id}

Security

jwtBearer (bearer)

Response status

200 400 401 403 404 409 429 500

Request and response schemas

JSON

{
  "requestBody": {
    "application/json": {
      "$ref": "#/components/schemas/UpdateApiKeyRequest"
    }
  },
  "responses": {
    "200": {
      "description": "API key updated",
      "content": {
        "application/json": {
          "$ref": "#/components/schemas/ApiKeyResponse"
        }
      }
    },
    "400": {
      "description": "Invalid request",
      "content": {
        "application/json": {
          "$ref": "#/components/schemas/RequestError"
        }
      }
    },
    "401": {
      "description": "Authentication required or invalid",
      "content": {
        "application/json": {
          "$ref": "#/components/schemas/SecurityError"
        }
      }
    },
    "403": {
      "description": "Authenticated but not permitted",
      "content": {
        "application/json": {
          "$ref": "#/components/schemas/SecurityError"
        }
      }
    },
    "404": {
      "description": "Requested API key was not found",
      "content": {
        "application/json": {
          "$ref": "#/components/schemas/ApiError"
        }
      }
    },
    "409": {
      "description": "API key is revoked or the active API-key limit would be exceeded",
      "content": {
        "application/json": {
          "$ref": "#/components/schemas/ApiError"
        }
      }
    },
    "429": {
      "description": "Rate limit exceeded",
      "content": {
        "application/json": {
          "$ref": "#/components/schemas/SecurityError"
        }
      }
    },
    "500": {
      "description": "Unexpected server error",
      "content": {
        "application/json": {
          "$ref": "#/components/schemas/ApiError"
        }
      }
    }
  }
}

PUT /api/v1/api-keys/{id} is JWT-only and replaces every editable setting without rotating or revealing the key secret. Send name, a nonempty scopes set, and enabled. You may also send future expiresAt, usageLimitNcu, and up to 50 allowedCidrs. A null expiry or usage limit clears that restriction; an empty CIDR set allows every client IP.

A revoked key cannot be edited. Re-enabling a key is subject to the active-key limit, and an expired key also needs its expiry cleared or moved into the future. usageLimitNcu cannot be lower than NCU already consumed or reserved in the current period. A key outside the account is reported as not found.

The response contains updated metadata, never the secret, and uses Cache-Control: no-store.

json

{"name":"Production deploys","scopes":["build:read","build:write","artifact:read"],"expiresAt":null,"usageLimitNcu":50000,"allowedCidrs":["203.0.113.0/24"],"enabled":true}