---
title: "Update an AI provider key"
method: PATCH
path: "/v1/workspaces/{workspaceId}/ai_provider_keys/{id}"
tags: ["AIProviderKeyService", "AI Provider Keys"]
---

# Update an AI provider key

`PATCH /v1/workspaces/{workspaceId}/ai_provider_keys/{id}`

Updates an AI provider key's name or key value in the workspace

## Path parameters

- `workspaceId` string, required
- `id` string, required

## Request body

- UpdateAIProviderKeyRequest
  - `workspaceId` string — The workspace the key belongs to.
  - `id` string — The key to update.
  - `metadata` UpdateResourceMetadata — UpdateResourceMetadata contains the user-provided fields for updating a workspace-scoped resource. Read-only fields (id, account_id, workspace_id, profile_id, created_at) are excluded since they are set by the server.
    - `name` string, required — Human-readable name for the resource (e.g., "Customer Support Agent", "Email Tool")
    - `externalId` string — External ID for the resource (e.g., a workflow ID from an external system)
    - `labels` object — Key-value pairs for categorization and filtering. Values are 0-63 alphanumeric characters with "-", "_", or "." allowed between; keys follow the same shape and additionally accept an optional DNS-subdomain prefix (e.g. "cadenya.com/") of at most 253 characters. Examples: {"environment": "production", "team": "platform", "version": "v2"}
  - `spec` AIProviderKeySpec
    - `provider` 'AI_PROVIDER_UNSPECIFIED' | 'AI_PROVIDER_OPENROUTER' | 'AI_PROVIDER_OPENAI' | 'AI_PROVIDER_ANTHROPIC' | 'AI_PROVIDER_GEMINI' | 'AI_PROVIDER_OPENAI_COMPATIBLE', enum — The AI provider this key authenticates against.
    - `credentials` union — AIProviderCredential is the secret material used to authenticate with a provider. The set case must correspond to AIProviderKeySpec.provider. The server encrypts the serialized message at rest and never returns it on reads.
      - AIProviderCredentialApiKey
        - `type` 'apiKey', required
        - `apiKey` CredentialAPIKey, required — CredentialAPIKey carries a single bearer/header API key.
          - `apiKey` string
      - AIProviderCredentialHeaders
        - `type` 'headers', required
        - `headers` CredentialHeaders, required — CredentialHeaders carries arbitrary HTTP headers sent with every request to the provider (e.g. {"Authorization": "Bearer ...", "X-Api-Key": "..."}).
          - `headers` object
    - `config` union — AIProviderConfig holds non-secret, provider-specific settings. The set case must correspond to AIProviderKeySpec.provider. Providers with no settings (Anthropic, Gemini) simply leave this unset. The endpoint of a named provider is fixed and intentionally not overridable here; use the OpenAI-compatible provider to target a custom endpoint.
      - AIProviderConfigOpenrouter
        - `type` 'openrouter', required
        - `openrouter` OpenRouterConfig, required — OpenRouterConfig holds OpenRouter-specific settings.
          - `region` string — Data-residency region (e.g. "us", "eu"). Empty uses the provider default.
      - AIProviderConfigOpenai
        - `type` 'openai', required
        - `openai` OpenAIConfig, required — OpenAIConfig holds OpenAI-specific settings.
          - `organizationId` string — Sent as the OpenAI-Organization header when set.
          - `projectId` string — Sent as the OpenAI-Project header when set.
      - AIProviderConfigOpenaiCompatible
        - `type` 'openaiCompatible', required
        - `openaiCompatible` OpenAICompatibleConfig, required — OpenAICompatibleConfig configures a generic endpoint that speaks the OpenAI Chat Completions API. The base URL is required and its model catalog is discovered live via GET {base_url}/models.
          - `baseUrl` string, required
  - `updateMask` string, field-mask — Fields to update.

## Response `200`

OK

- AIProviderKey — AIProviderKey is a credential for an AI provider, scoped to a workspace. Most keys are customer-provided (BYOK); Cadenya also provisions promotional keys (see AIProviderKeyInfo.is_promotional), which cannot be modified or deleted by account administrators. The secret value is never returned in responses.
  - `metadata` ResourceMetadata, required — Standard metadata for persistent, named resources (e.g., agents, tools, prompts)
    - `id` string, required — Unique identifier for the resource (prefixed ULID, e.g., "agent_01HXK...")
    - `accountId` string, required — Account this resource belongs to for multi-tenant isolation (prefixed ULID)
    - `workspaceId` string, required — Workspace this resource belongs to for organizational grouping (prefixed ULID)
    - `name` string, required — Human-readable name for the resource (e.g., "Customer Support Agent", "Email Tool") Required for resources that users interact with directly
    - `externalId` string — External ID for the resource (e.g., a workflow ID from an external system)
    - `labels` object — Key-value pairs for categorization and filtering. Values are 0-63 alphanumeric characters with "-", "_", or "." allowed between; keys follow the same shape and additionally accept an optional DNS-subdomain prefix (e.g. "cadenya.com/") of at most 253 characters. Examples: {"environment": "production", "team": "platform", "version": "v2"}
    - `profileId` string, required — ID of the actor (user or service account) that created this resource
    - `createdAt` string, date-time, required — Timestamp when this resource was created
    - `updatedAt` string, date-time — Timestamp when this resource was last updated
  - `spec` AIProviderKeySpec, required
    - `provider` 'AI_PROVIDER_UNSPECIFIED' | 'AI_PROVIDER_OPENROUTER' | 'AI_PROVIDER_OPENAI' | 'AI_PROVIDER_ANTHROPIC' | 'AI_PROVIDER_GEMINI' | 'AI_PROVIDER_OPENAI_COMPATIBLE', enum — The AI provider this key authenticates against.
    - `credentials` union — AIProviderCredential is the secret material used to authenticate with a provider. The set case must correspond to AIProviderKeySpec.provider. The server encrypts the serialized message at rest and never returns it on reads.
      - AIProviderCredentialApiKey
        - `type` 'apiKey', required
        - `apiKey` CredentialAPIKey, required — CredentialAPIKey carries a single bearer/header API key.
          - `apiKey` string
      - AIProviderCredentialHeaders
        - `type` 'headers', required
        - `headers` CredentialHeaders, required — CredentialHeaders carries arbitrary HTTP headers sent with every request to the provider (e.g. {"Authorization": "Bearer ...", "X-Api-Key": "..."}).
          - `headers` object
    - `config` union — AIProviderConfig holds non-secret, provider-specific settings. The set case must correspond to AIProviderKeySpec.provider. Providers with no settings (Anthropic, Gemini) simply leave this unset. The endpoint of a named provider is fixed and intentionally not overridable here; use the OpenAI-compatible provider to target a custom endpoint.
      - AIProviderConfigOpenrouter
        - `type` 'openrouter', required
        - `openrouter` OpenRouterConfig, required — OpenRouterConfig holds OpenRouter-specific settings.
          - `region` string — Data-residency region (e.g. "us", "eu"). Empty uses the provider default.
      - AIProviderConfigOpenai
        - `type` 'openai', required
        - `openai` OpenAIConfig, required — OpenAIConfig holds OpenAI-specific settings.
          - `organizationId` string — Sent as the OpenAI-Organization header when set.
          - `projectId` string — Sent as the OpenAI-Project header when set.
      - AIProviderConfigOpenaiCompatible
        - `type` 'openaiCompatible', required
        - `openaiCompatible` OpenAICompatibleConfig, required — OpenAICompatibleConfig configures a generic endpoint that speaks the OpenAI Chat Completions API. The base URL is required and its model catalog is discovered live via GET {base_url}/models.
          - `baseUrl` string, required
  - `info` AIProviderKeyInfo — AIProviderKeyInfo carries server-derived, read-only details about a key, for AI provider management UIs.
    - `enabledModelCount` integer — Number of enabled models provisioned on this key.
    - `disabledModelCount` integer — Number of disabled models provisioned on this key.
    - `isPromotional` boolean — Cadenya includes promotional keys (one for onboarding, and potentially more in the future). These are not added or maintained by account administrators.

## Other responses

- `default` — Default error response

## Changes

- **2026-07-19** `3ecc1debabfa` — 6 breaking, 10 warning, 6 info
  - the `spec/config/allOf[#/components/schemas/AIProviderConfig]/` request property type/format changed from `object`/`` to ``/``
  - the `spec/credentials/allOf[#/components/schemas/AIProviderCredential]/` request property type/format changed from `object`/`` to ``/``
  - added `#/components/schemas/AIProviderConfig_Openrouter, #/components/schemas/AIProviderConfig_Openai, #/components/schemas/AIProviderConfig_OpenaiCompatible` to the `spec/config/allOf[#/components/schemas/AIProviderConfig]/` response property `oneOf` list for the response status `200`
  - added `#/components/schemas/AIProviderCredential_ApiKey, #/components/schemas/AIProviderCredential_Headers` to the `spec/credentials/allOf[#/components/schemas/AIProviderCredential]/` response property `oneOf` list for the response status `200`
  - …18 more
- **2026-07-02** `06e0e37c1499` — 10 warning, 8 info
  - removed the request property `metadata/bundleKey`
  - removed the request property `spec/apiKey`
  - removed the request property `spec/openrouter`
  - removed the optional property `metadata/bundleKey` from the response with the `200` status
  - …14 more
- **2026-06-12** `ea07a25ab5da` — 1 info
  - added the optional property `info/allOf[#/components/schemas/AIProviderKeyInfo]/isPromotional` to the response with the `200` status
- …earlier changes not shown

[Full history](https://skmtc.dev/cadenya/apis/cadenya-api/changes/v1/workspaces/:workspaceId/ai_provider_keys/:id/patch.md)

---

[API](https://skmtc.dev/cadenya/apis/cadenya-api.md) · [All operations](https://skmtc.dev/cadenya/apis/cadenya-api/llms.txt) · [OpenAPI document](https://skmtc-service-production.skmtc.workers.dev/v1/apis/cadenya/cadenya-api/revisions/ac1a7f084068/schema)