--- title: "Edit an API key budget" method: PATCH path: "/v1/orgs/{orgId}/api-keys/{id}" tags: ["API Keys"] --- # Edit an API key budget `PATCH /v1/orgs/{orgId}/api-keys/{id}` ## Request - Base URL: `https://api.openrelay.inc` - URL: `https://api.openrelay.inc/v1/orgs/{orgId}/api-keys/{id}` - Auth: HTTP bearer Sets, changes or removes an API key's spend budget and returns the key with its current spend. A limitNanoUsd of 0 removes the budget. Requires a signed-in session: your own key, or apikeys.write for any key. In organizations with permissions enabled, only the budget can be edited. Name, note and restrictions return 400. Available with permissions enabled; otherwise 404. Checked against the `apikey.update` permission for the resource it acts on. See [Permissions](https://docs.openrelay.inc/docs/permissions) for the roles and API key permissions that include it. ## Path parameters - `orgId` string, required - `id` string, required ## Request body - UpdateApiKeyRequest - `budget` KeyBudgetEdit: A change to the key's spend budget. A field left out keeps its value, so a key without a budget needs limitNanoUsd; a limitNanoUsd of 0 removes the budget. A new limit on the same period keeps the spend counted so far in the period; a new period, or a budget on a key that had none, counts from the update. - `limitNanoUsd` integer: The most the key may spend per period, in nanoUSD (1 USD = 1,000,000,000); 0 removes the budget. - `period` 'lifetime' | 'daily' | 'monthly': lifetime never resets. daily resets at 00:00 UTC and monthly at 00:00 UTC on the first of the month. - `name` string - `note` string - `restrictions` KeyRestrictions - `endpoints` string[]: Dedicated endpoint ids the key may call. - `ipRanges` string[]: IPv4 or IPv6 CIDRs the key may be used from, at most 20. - `models` string[]: Model ids the key may call. Absent means every model the organization offers. - `permissions` string[]: The key's permission ceiling, as permission ids (compute.write). The key can never do more than its owner; absent means the owner's access. ## Response `200` Updated - ApiKeySummary - `budget` KeyBudget: The key's spend budget and what the key has spent in the current period. Amounts are integer nanoUSD (1 USD = 1,000,000,000). Every inference request the key makes counts, batches included, at the price it is billed, from when the budget was set; compute (VMs and pods) is not counted. - `limitNanoUsd` integer, required: The most the key may spend per period. - `period` 'lifetime' | 'daily' | 'monthly', required: lifetime never resets. daily resets at 00:00 UTC and monthly at 00:00 UTC on the first of the month. - `periodEndsAt` string, date-time: When the current period ends and the spend starts again from zero; absent for a lifetime budget. - `spentNanoUsd` integer: What the key has spent in the current period; absent when the spend could not be read. - `createdAt` string, required - `createdBy` string - `expiresAt` string - `id` string, required - `keyPrefix` string, required - `kind` 'personal' | 'org' | 'legacy': Absent for a key created before permissions (legacy). - `lastUsedAt` string - `name` string, required - `note` string: Where the key is used. - `ownerUserId` string: A personal key's owner. - `restrictions` KeyRestrictions - `endpoints` string[]: Dedicated endpoint ids the key may call. - `ipRanges` string[]: IPv4 or IPv6 CIDRs the key may be used from, at most 20. - `models` string[]: Model ids the key may call. Absent means every model the organization offers. - `permissions` string[]: The key's permission ceiling, as permission ids (compute.write). The key can never do more than its owner; absent means the owner's access. - `revokedAt` string - `scopes` string[], required ## Other responses - `400`: The request is invalid - `401`: Missing or invalid API key - `403`: The caller is authenticated but may not do this. The caller's role or the API key's permissions do not allow it, or the request targets another organization (FORBIDDEN, or NOT_A_MEMBER for a session); a permission denial also names the action it needed (permission), which kind of policy denied it (deniedBy) and the deciding policy ids (policies). Or the organization is suspended pending review (ORG_SUSPENDED) or has been deleted (ORG_DISABLED). A new API key or a wider scope clears neither of the last two; see [Account and balance refusals](https://docs.openrelay.inc/docs/errors#account-and-balance-refusals). A user session whose email address is not confirmed is refused on every operation (EMAIL_UNVERIFIED); confirm the address from the confirmation email, then sign in again. - `404`: Resource not found ## Changes - **2026-10-26** `7fe59d94a9f5`: 4 info - added the optional property `requestId` to the response with the `400` status - added the optional property `requestId` to the response with the `401` status - added the optional property `requestId` to the response with the `403` status - added the optional property `requestId` to the response with the `404` status - **2026-10-22** `551a288b9aa0`: 1 warning, 1 info - removed the optional property `serviceAccountId` from the response with the `200` status - removed the `service` enum value from the `kind` response property for the response status `200` - **2026-10-16** `5497aead7e4d`: 3 info - request property `name` deprecated - request property `note` deprecated - request property `restrictions` deprecated - **2026-10-16** `f53dbf66a389`: 2 info - added the new optional request property `budget` - added the optional property `budget` to the response with the `200` status - **2026-10-12** `f5f2b1004ded`: 1 warning - added the new `org` enum value to the `kind` response property for the response status `200` [Operation history](https://skmtc.dev/openrelay/apis/openrelay-api/changes/v1/orgs/:orgId/api-keys/:id/patch.md) --- [API](https://skmtc.dev/openrelay/apis/openrelay-api.md) - [All operations](https://skmtc.dev/openrelay/apis/openrelay-api/llms.txt) - [OpenAPI document](https://skmtc.dev/openrelay/apis/openrelay-api/revisions/7fe59d94a9f5?raw)