---
title: "Set, change or remove the key's webhook"
method: PATCH
path: "/o/{org}/api-keys/{key}"
tags: ["API keys"]
---

# Set, change or remove the key's webhook

`PATCH /o/{org}/api-keys/{key}`

## Request

- Base URL: `https://api.prix.dev`
- URL: `https://api.prix.dev/o/{org}/api-keys/{key}`
- Auth: HTTP bearer

Points the `runFinished` webhook of every run this key starts at a
public https URL, or clears it with `null`. The signing secret
(`webhook_secret`, `whsec_…`) is returned once, when the key first gets
a URL and again on `rotate_secret: true`; changing the URL keeps it.
Only the key's creator may call this.

## Request body

- object
  - `webhook_url` string, uri, nullable
  - `rotate_secret` boolean

## Response `200`

The key; `webhook_secret` only when a secret was minted.

- ApiKey
  - `id` string, required: `key_…`; use it in the key routes.
  - `kind` 'key' | 'oauth': `key` is minted here; `oauth` is an MCP client a person connected by signing in. An `oauth` grant reaches only the MCP server, cannot be rotated and has no webhook; its `expires_at` is when it ends unless the client refreshes it.
  - `name` string, required
  - `prefix` string, required: The secret's first characters, to tell keys apart.
  - `scopes` ApiKeyScope[], required
  - `max_concurrent` integer, required
  - `webhook_url` string, nullable, required
  - `expires_at` string, date-time, nullable, required
  - `created_by` object, required
    - `id` string, required
    - `email` string, nullable, required
  - `last_used_at` string, date-time, nullable, required
  - `created_at` string, date-time, required
  - `stats` object: The runs the key started in the last seven days. Only in the list. `finished` counts runs that ended `completed` or `needs_review`, out of `ended`. `webhook_deliveries` is the state of each run's latest completion webhook: delivered, still being retried, or dropped after the last try.
    - `since` string, date-time, required
    - `runs` integer, required
    - `finished` integer, required
    - `ended` integer, required
    - `spend_usd` number, required
    - `mcp_runs` integer, required: Of `runs`, those started through MCP.
    - `webhook_deliveries` object, required
      - `delivered` integer, required
      - `retrying` integer, required
      - `failed` integer, required
  - `secret` string: The key's secret. Only in the create and rotate responses; never shown again.
  - `webhook_secret` string: The webhook signing secret. Only in the update response that minted it.

## Other responses

- `400`: An unknown field, a URL that is not public https, or `rotate_secret` with no URL (`VALIDATION_ERROR`).
- `401`: No bearer, an unknown, revoked or expired one, or an API key on a route keys cannot call.
- `404`: No such resource for the caller, including one in an org the caller is not in or a Project that is private to someone else.

---

[API](https://skmtc.dev/getrush/apis/rush-api.md) · [All operations](https://skmtc.dev/getrush/apis/rush-api/llms.txt) · [OpenAPI document](https://skmtc.dev/getrush/apis/rush-api/revisions/e351f947926b?raw)