---
title: "Update an API key"
method: PATCH
path: "/apiKeys/{apiKeyId}"
tags: ["API keys"]
---

# Update an API key

`PATCH /apiKeys/{apiKeyId}`

## Request

- Base URL: `https://api.cactal.ai/v1`
- URL: `https://api.cactal.ai/v1/apiKeys/{apiKeyId}`
- Auth: HTTP bearer

Updates `name`, `expiresAt`, and/or `access`; omitted fields are left unchanged, and sending none returns the current metadata. Providing `access` replaces the entire access configuration atomically — previous grants are removed and the change applies to the next request that uses the key; any website id belonging to another organization fails with 400. On a revoked or already-expired key, setting `expiresAt` (including `null` to remove expiry) or `access` fails with 409, because inactive keys cannot be made active again; renames still succeed.

## Path parameters

- `apiKeyId` string, required

## Request body

- object
  - `name` string
  - `expiresAt` union
    - unknown
    - string, date-time
  - `access` union: When provided, replaces the entire access configuration of the key atomically; previous grants are removed. Omit to leave access unchanged.
    - object
      - `kind` 'organization', required: Grants one role across the entire organization.
      - `role` 'admin' | 'full_editor' | 'content_editor', required: Organization-wide role held by the key.
    - object
      - `kind` 'websites', required: Grants one role on an explicit set of websites.
      - `websiteIds` string[], required: Ids of the websites the key can access. All must belong to the organization of the key.
      - `role` 'content_editor' | 'full_editor', required: Role held by the key on each listed website.

## Response `200`

The updated key metadata.

- object
  - `id` string, required: Unique id of the API key.
  - `name` string, required: Human-readable label, 1–200 characters.
  - `organizationId` string, required: Id of the organization that owns the key.
  - `access` union, required: Access configuration of an API key: either one organization-wide role, or one role across an explicit set of websites. The `owner` role can never be granted to an API key.
    - object
      - `kind` 'organization', required: Grants one role across the entire organization.
      - `role` 'admin' | 'full_editor' | 'content_editor', required: Organization-wide role held by the key.
    - object
      - `kind` 'websites', required: Grants one role on an explicit set of websites.
      - `websiteIds` string[], required: Ids of the websites the key can access. All must belong to the organization of the key.
      - `role` 'content_editor' | 'full_editor', required: Role held by the key on each listed website.
  - `expiresAt` string, date-time, nullable, required: When the key stops authenticating. `null` when it never expires.
  - `revokedAt` string, date-time, nullable, required: When the key was revoked. `null` while the key is active.
  - `createdAt` string, date-time, required: When the key was created.

## Other responses

- `400`: Validation failed. The response `message` names the first invalid field.
- `401`: Missing, invalid, expired, or revoked API key.
- `403`: The authenticated principal lacks the required capability.
- `404`: The resource does not exist or is outside the principal’s access scope.
- `409`: The request conflicts with the current state of the resource.
- `429`: Rate limit exceeded. Retry after the number of seconds in the `Retry-After` header.

---

[API](https://skmtc.dev/cactal/apis/cactal-api.md) · [All operations](https://skmtc.dev/cactal/apis/cactal-api/llms.txt) · [OpenAPI document](https://skmtc.dev/cactal/apis/cactal-api/revisions/9cd0fb5eacdd?raw)