---
title: "Update an API key rule."
method: PATCH
path: "/orgs/{org}/api-key-rules/{slug_perm}/"
tags: ["orgs"]
---

# Update an API key rule.

`PATCH /orgs/{org}/api-key-rules/{slug_perm}/`

Update an API key rule.

## Request body

- OrganizationApiKeyRuleRequestPatch
  - `enforce_refresh` boolean — When enabled, API's keys that violate the organization's policy will be replaced automatically.
  - `is_enabled` boolean — Whether this policy is currently active and enforced.
  - `max_age_hours` integer, nullable — The maximum permitted age of an API key for use in the organization. API keys older than this will no longer have access until they are refreshed. To disable the policy unset this value.
  - `refresh_immediately` boolean — If set to True, API keys that violate this rule will be replaced immediately after the request is made. There is no way to undo this.
  - `rule_type` 'All Accounts' | 'Service Accounts' | 'User Accounts' — Specify which account types this rule applies to: all accounts (deprecated — prefer separate service/user rules), service accounts only, or user accounts only.

## Response `200`

OK

- OrganizationApiKeyRule
  - `created_at` string, date-time
  - `enforce_refresh` boolean — When enabled, API's keys that violate the organization's policy will be replaced automatically.
  - `is_enabled` boolean — Whether this policy is currently active and enforced.
  - `last_applied_at` string, date-time — The last time this policy was evaluated and applied by the expiry task.
  - `max_age_hours` integer, nullable — The maximum permitted age of an API key for use in the organization. API keys older than this will no longer have access until they are refreshed. To disable the policy unset this value.
  - `rule_type` 'All Accounts' | 'Service Accounts' | 'User Accounts', required — Specify which account types this rule applies to: all accounts (deprecated — prefer separate service/user rules), service accounts only, or user accounts only.
  - `slug` string, slug — Human-readable identifier for the policy type. Automatically generated based on policy_type.
  - `slug_perm` string, slug — An auto-generated id that uniquely identifies the API key policy.
  - `updated_at` string, date-time

## Other responses

- `400` — Request could not be processed (see detail).
- `422` — Missing or invalid parameters (see detail).

## Changes

- **2026-09-03** `d84142c9e5ad` — 1 info
  - endpoint added

[Change history](https://skmtc.dev/cloudsmith/apis/cloudsmith-api-v1/changes/orgs/:org/api-key-rules/:slug_perm/patch.md)

---

[API](https://skmtc.dev/cloudsmith/apis/cloudsmith-api-v1.md) · [All operations](https://skmtc.dev/cloudsmith/apis/cloudsmith-api-v1/llms.txt) · [OpenAPI document](https://skmtc-service-production.skmtc.workers.dev/v1/apis/cloudsmith/cloudsmith-api-v1/revisions/d84142c9e5ad/schema)