---
title: "Update one"
method: PATCH
path: "/v1/sii/keys/{sii_key_id}"
tags: ["SII Key"]
---

# Update one

`PATCH /v1/sii/keys/{sii_key_id}`

Rotates the credentials of an SII key. All fields are optional; send only what
changes. When the update touches a key that is not already `approved`, Cardda
re-runs the company sync asynchronously afterwards. The response omits
`company_ids` (it includes `can_issue?`).

## Path parameters

- `sii_key_id` string, uuid, required

## Parameters

- `#/paths/~1v1~1sii~1keys/get/parameters/0` — unresolved $ref

## Request body

- SiiKeyUpdate — All fields are optional; send only what you want to change. Note the SII portal RUT (`rut`) can be re-pointed, and either credential can be rotated.
  - `rut` string — New RUT for the credential (digits plus verifier digit, no dots).
  - `password` string — New SII portal password. Stored encrypted; never returned.
  - `certificate_password` string — New digital-certificate password. Stored encrypted; never returned.

## Response `200`

The updated SII key.

- SiiKey
  - `id` string, uuid, required — UUID of the SII key.
  - `rut` string, required — Tax id (RUT) the certificate belongs to, stored as bare digits plus the verifier digit (e.g. `761234567` or `12345678K`). Unique across all SII keys.
  - `user_id` string, nullable — Firebase user id of the person who provided the credential.
  - `status` 'approved' | 'pending' | 'canceled' | 'declined', required — Lifecycle status of the credential. | Value | Meaning | | ----- | ------- | | `pending` | Just created; Cardda has not yet validated it against the SII. | | `approved` | Validated; the key can sync companies and invoices. | | `declined` | The SII rejected the credentials (`auth/wrong-credentials`). | | `canceled` | The credential was disabled. |
  - `issuer_phone` integer, nullable — Phone number registered for the issuer, when captured.
  - `last_synced_at` string, date-time, nullable — Timestamp of the last successful invoice/company sync.
  - `can_issue` boolean — Whether the key can issue electronic documents — true when `status` is `approved` **and** a certificate password is present. **Note:** this field is serialized with a trailing question mark in the JSON response (`can_issue?`).
  - `company_ids` string[] — UUIDs of the companies this key manages (resolved through the SII managers join). Present on the list and detail responses; omitted from the update response.
  - `created_at` string, date-time — When the key was created in Cardda.
  - `updated_at` string, date-time — When the key was last updated.

## Other responses

- `401` — Unauthorized — missing/invalid token, or the caller lacks `sii_keys_manage` and does not own the key. Auth is by key ownership or `sii_keys_manage` permission; the `company-id` header is not used to scope this operation. Empty body.
- `404` — SII key not found. Body: `{ "message": "Resource not found" }`.

---

[API](https://skmtc.dev/cardda/apis/banking-api.md) · [All operations](https://skmtc.dev/cardda/apis/banking-api/llms.txt) · [OpenAPI document](https://skmtc-service-production.skmtc.workers.dev/v1/apis/cardda/banking-api/revisions/ff1aeb3fda8b/schema)