---
title: "Change an account's label, access or scope"
method: PATCH
path: "/provider-accounts/{id}"
tags: ["Provider accounts"]
---

# Change an account's label, access or scope

`PATCH /provider-accounts/{id}`

## Request

- Base URL: `https://api.customdomain.ai/v1`
- URL: `https://api.customdomain.ai/v1/provider-accounts/{id}`
- Auth: HTTP bearer

Narrowing the scope detaches the domains it no longer covers; they stay connected, without continuous access. Switching to `one_time` deletes the key now. Switching to `continuous` needs the key still held. Changing `access`, `scope` or `domains` takes an admin, an owner or the member who connected the account (`403` otherwise); the label is anyone's who operates applications.

## Path parameters

- `id` string, required

## Request body

- object
  - `label` string
  - `access` 'continuous' | 'one_time'
  - `scope` 'all' | 'selected'
  - `domains` string[]

## Response `200`

The account

- object
  - `account` ProviderAccount
    - `id` string, required
    - `kind` 'api_key', required
    - `provider` string, required
    - `provider_name` string, required
    - `label` string, required
    - `access` 'continuous' | 'one_time', required
    - `scope` 'all' | 'selected', required
    - `domains` string[], required: The selected zones (scope `selected`).
    - `credential_held` boolean, required: Whether the key is still kept and usable (false for a one time account past its hour). The key itself is never returned.
    - `status` 'active' | 'used' | 'expired' | 'needs_reconnect', required
    - `last_error` string
    - `created_by` string
    - `last_used_at` string, date-time
    - `expires_at` string, date-time: When a one time account's key is deleted at the latest.
    - `created_at` string, date-time, required
    - `updated_at` string, date-time
    - `connections` AccountConnection[], required
      - `id` string
      - `application_id` string
      - `domain` string
      - `status` string
    - `uses` string[], required: What the account's access is used for.
    - `can_manage` boolean, required: Whether the caller may change the account's access, scope or domains, connect domains with it and replace its key: an admin, an owner, or the member who connected it.

## Other responses

- `400`: Error envelope: {code, title, details}.
- `401`: Error envelope: {code, title, details}.
- `403`: Error envelope: {code, title, details}.
- `404`: Error envelope: {code, title, details}.
- `409`: Error envelope: {code, title, details}.

---

[API](https://skmtc.dev/customdomain/apis/customdomain-control-plane-api.md) · [All operations](https://skmtc.dev/customdomain/apis/customdomain-control-plane-api/llms.txt) · [OpenAPI document](https://skmtc.dev/customdomain/apis/customdomain-control-plane-api/revisions/34d89cb7a7cd?raw)