---
title: "Update an API key"
method: PATCH
path: "/v1/api-keys/{label}"
tags: ["API Keys"]
---

# Update an API key

`PATCH /v1/api-keys/{label}`

Updates an API key's metadata (currently only the label).

## Path parameters

- `label` string, required — Current label of the API key.

## Request body

- UpdateApiKeyRequest
  - `label` string — New label for the key.

## Response `200`

Updated API key metadata (never the full key)

- ApiKey
  - `label` string, required — Human-readable label. Unique per workspace.
  - `keyPrefix` string, required — Display prefix of the key (e.g. "monid_test_a1b2c3d4...").
  - `owner` string, required — User id the key belongs to (bills to, listed under). Always a user; a child key inherits its parent's owner.
  - `createdBy` string, required — Who minted the key — `USER#<id>` (dashboard), `API_KEY#<fingerprint>` (another key), `AEP#<did>` (AEP grant) — an actor id: `USER#<userId>` (dashboard), `API_KEY#<fingerprint>` (another key), `AEP#<did>` (an enrolled agent), `CLERK`, `SYSTEM`.
  - `scopes` string[], required — Scope grants: `{resource}:{action}` over runs, resources, wallet, topups, controls and api_keys with read/create/update/delete, plus `{resource}:*` and `*`. Catalog reads need no scope. Fixed at creation.
  - `status` 'ACTIVE' | 'EXPIRED' | 'REVOKED', required — ACTIVE, EXPIRED (derived from expiresAt) or REVOKED. Only ACTIVE keys authenticate.
  - `origin` 'DASHBOARD' | 'API' | 'AEP' | 'SYSTEM', required — Channel the key was minted through — derived from `createdBy`: DASHBOARD, API, AEP or SYSTEM.
  - `expiresAt` string, date-time — Expiry (ISO 8601). Absent ⇒ never expires.
  - `revokedAt` string, date-time — When the key was revoked. Present only when REVOKED.
  - `revokedBy` string — Who revoked the key (present only when REVOKED) — an actor id: `USER#<userId>` (dashboard), `API_KEY#<fingerprint>` (another key), `AEP#<did>` (an enrolled agent), `CLERK`, `SYSTEM`.
  - `createdAt` string, date-time, required — Creation time (ISO 8601).
  - `lastUsedAt` string, date-time — Last time the key authenticated a request. Absent if never used.

## Other responses

- `400` — Bad request — input failed validation
- `401` — Unauthorized — missing or invalid credentials
- `403` — Forbidden — caller has no workspace or no access
- `404` — API key not found in this workspace
- `500` — Internal server error

## Changes

- **2026-09-25** `5abada71ceae` — 65 warning, 7 info
  - added the new `IDENTITY_ALREADY_LINKED` enum value to the `errorCode` response property for the response status `400`
  - added the new `IDENTITY_ALREADY_LINKED` enum value to the `errorCode` response property for the response status `401`
  - added the new `IDENTITY_ALREADY_LINKED` enum value to the `errorCode` response property for the response status `403`
  - added the new `IDENTITY_ALREADY_LINKED` enum value to the `errorCode` response property for the response status `404`
  - …68 more
- **2026-09-23** `fadab791136c` — 5 warning
  - added the new `X402_UNBOUNDED_PRICE` enum value to the `errorCode` response property for the response status `400`
  - added the new `X402_UNBOUNDED_PRICE` enum value to the `errorCode` response property for the response status `401`
  - added the new `X402_UNBOUNDED_PRICE` enum value to the `errorCode` response property for the response status `403`
  - added the new `X402_UNBOUNDED_PRICE` enum value to the `errorCode` response property for the response status `404`
  - …1 more
- **2026-09-11** `9874d9e34fcf` — 5 info
  - added the optional property `errorCode` to the response with the `400` status
  - added the optional property `errorCode` to the response with the `401` status
  - added the optional property `errorCode` to the response with the `403` status
  - added the optional property `errorCode` to the response with the `404` status
  - …1 more

[Change history](https://skmtc.dev/monid/apis/monid-api/changes/v1/api-keys/:label/patch.md)

---

[API](https://skmtc.dev/monid/apis/monid-api.md) · [All operations](https://skmtc.dev/monid/apis/monid-api/llms.txt) · [OpenAPI document](https://skmtc.dev/monid/apis/monid-api/revisions/99cc8f5bdff4?raw)