---
title: "Tighten another key's policy (lower caps/limits, drop scopes). Requires control:manage. Loosening needs an owner in the console. Every external action needs a person's approval; autonomous_external_actions is deprecated, accepted only as false and always reported as false."
method: PATCH
path: "/v1/keys/{id}"
tags: ["Guard"]
---

# Tighten another key's policy (lower caps/limits, drop scopes). Requires control:manage. Loosening needs an owner in the console. Every external action needs a person's approval; autonomous_external_actions is deprecated, accepted only as false and always reported as false.

`PATCH /v1/keys/{id}`

## Request

- Base URL: `https://api.layrcake.dev`
- URL: `https://api.layrcake.dev/v1/keys/{id}`
- Auth: HTTP bearer

## Path parameters

- `id` string, uuid, required

## Headers

- `Idempotency-Key` string, required

## Request body

- object
  - `name` string
  - `scopes` string[]
  - `monthly_spend_cap` string, nullable
  - `autonomous_external_actions` false
  - `autonomous_action_limits` object
    - `max_recipients_per_action` integer, nullable
    - `max_assets_per_purchase` integer, nullable
    - `max_replies_per_day` integer, nullable
    - `require_run` boolean, nullable
  - `premium_offers` 'ask' | 'never'
  - `premium_max_credits_per_call` string
  - `data_route` 'balanced' | 'cheapest' | 'broadest' | 'fastest', nullable

## Response `200`

The key's policy after the change

- object
  - `result` object, required
    - `policy` object, required
      - `key_id` string, required
      - `name` string, required
      - `scopes` string[], required
      - `monthly_spend_cap` string, nullable, required
      - `autonomous_external_actions` false, required
      - `autonomous_action_limits` object, required
        - `max_recipients_per_action` integer, nullable, required
        - `max_assets_per_purchase` integer, nullable, required
        - `max_replies_per_day` integer, nullable, required
        - `require_run` true
      - `oauth_connection_id` string, nullable, required
      - `premium_offers` 'ask' | 'never'
      - `premium_max_credits_per_call` string
      - `data_route` 'balanced' | 'cheapest' | 'broadest' | 'fastest'
    - `direction` 'tighten' | 'loosen' | 'neutral' | 'mixed', required
    - `changed_fields` string[], required
    - `replayed` boolean, required

## Other responses

- `403`: owner_required (loosening), self_modification (own key), missing scope
- `409`: Idempotency-Key reused with different parameters

---

[API](https://skmtc.dev/layrcake/apis/layrcake-api.md) · [All operations](https://skmtc.dev/layrcake/apis/layrcake-api/llms.txt) · [OpenAPI document](https://skmtc.dev/layrcake/apis/layrcake-api/revisions/24c80e33c274?raw)