Change a key’s name, permissions, expiry or scope; its value never changes

A key never makes or changes a key into more than it has itself: every group at or under its own level, its scope inside its own (a workspace key makes keys only for that workspace, never one for every workspace), and an expiry no later than its own when it expires. It changes or revokes only keys already within its own access, and only narrows itself; anything past that is 403 key_escalation. A signed in session may do anything to its own keys. A computer’s own key manages no keys (403 computer_key), nor does a key for one computer (403 computer_scope). An expired key answers 401 key_expired. Send only what changes. permissions: "full", "read_only" or an object of group to level. expires_in_days (1 to 365) or expires_at (a date within a year; null removes the expiry). workspace_id: a workspace, or null for every workspace. A computer’s own key is Orgo’s: 409 managed_key. A key for one computer keeps its computer: workspace_id or computer_id is 400 computer_scope_fixed.