---
title: "Update a management key"
method: PATCH
path: "/v2/management-keys/{management_key_id}"
tags: ["Management keys"]
---

# Update a management key

`PATCH /v2/management-keys/{management_key_id}`

Updates mutable fields of a management key: display name, status (active / disabled / revoked), permission mode and access map, and expiry. Omitted fields keep their current values.

## Path parameters

- `management_key_id` string, required

## Request body

- UpdateManagementKeyRequest
  - `name` string — New name. Omit to keep current.
  - `status` 'MANAGEMENT_KEY_STATUS_UNSPECIFIED' | 'MANAGEMENT_KEY_STATUS_ACTIVE' | 'MANAGEMENT_KEY_STATUS_DISABLED' | 'MANAGEMENT_KEY_STATUS_REVOKED'
  - `permission_mode` 'MANAGEMENT_PERMISSION_MODE_UNSPECIFIED' | 'MANAGEMENT_PERMISSION_MODE_ALL' | 'MANAGEMENT_PERMISSION_MODE_RESTRICTED' | 'MANAGEMENT_PERMISSION_MODE_READ_ONLY'
  - `access` object — Replacement access map. Required when changing to `MANAGEMENT_PERMISSION_MODE_RESTRICTED`; ignored otherwise. Provide an empty map to clear.
  - `expires_at` string, date-time — New expiration. Omit to keep current. Set `clear_expires_at = true` to remove an existing expiration.
  - `clear_expires_at` boolean — Force-clear the expiration. Mutually exclusive with `expires_at`.

## Response `200`

OK

- UpdateManagementKeyResponse
  - `management_key` ManagementKey, required — ManagementKey defines permissions, expiration, and revocation for a management key. Management keys are always workspace-scoped — there is no project_scope field, and they have no per-user owner (every management key is workspace-owned; `created_by_id` records who created it).
    - `management_key_id` string, required — Canonical key identifier (ULID). Embedded in opaque tokens as `sk-orq-<id>-<secret>`.
    - `name` string, required — Human-readable name shown in the dashboard.
    - `permission_mode` 'MANAGEMENT_PERMISSION_MODE_UNSPECIFIED' | 'MANAGEMENT_PERMISSION_MODE_ALL' | 'MANAGEMENT_PERMISSION_MODE_RESTRICTED' | 'MANAGEMENT_PERMISSION_MODE_READ_ONLY', required
    - `access` object — Per-domain access map. Only populated when `permission_mode` is `MANAGEMENT_PERMISSION_MODE_RESTRICTED`. The authoritative list of valid keys (Domain.id values) is returned by the List management capability catalog endpoint (GET /v2/management-keys/capabilities).
    - `token_prefix` string, required — Displayable prefix for UI listings (e.g. "sk-orq-01HXY..."). Safe to expose.
    - `status` 'MANAGEMENT_KEY_STATUS_UNSPECIFIED' | 'MANAGEMENT_KEY_STATUS_ACTIVE' | 'MANAGEMENT_KEY_STATUS_DISABLED' | 'MANAGEMENT_KEY_STATUS_REVOKED', required
    - `created_by_id` string — Audit: user who created the key.
    - `updated_by_id` string — Audit: user who last updated the key.
    - `created_at` string, date-time, required — Time the key was created.
    - `updated_at` string, date-time, required — Time the key was last updated.
    - `last_used_at` string, date-time — Last authenticated use.
    - `expires_at` string, date-time — Optional expiration. The authenticate hot-path rejects keys whose `expires_at` is in the past. Unset means the key never expires.

## Changes

> 372 revisions in range; 155 not diffed.

- **2026-08-24** `addad33219df` — 3 breaking, 3 warning, 3 info
  - request property `access/additionalProperties/` was restricted to a list of enum values
  - the `access/additionalProperties/` request property type changed from `integer` to `string`, and format from `enum` to no format
  - the `management_key/allOf[#/components/schemas/ManagementKey]/access/additionalProperties/` response's property type changed from `integer` to `string`, and format from `enum` to no format for status `200`
  - added the new `ACCESS_LEVEL_NONE` enum value to the `management_key/allOf[#/components/schemas/ManagementKey]/access/additionalProperties/` response property for the response status `200`
  - …5 more
- **2026-08-21** `1586760a252f` — 5 breaking, 3 info
  - removed the enum value `ACCESS_LEVEL_NONE` of the request property `access/additionalProperties/`
  - removed the enum value `ACCESS_LEVEL_READ` of the request property `access/additionalProperties/`
  - removed the enum value `ACCESS_LEVEL_WRITE` of the request property `access/additionalProperties/`
  - the `access/additionalProperties/` request property type changed from `string` to `integer`, and format from no format to `enum`
  - …4 more
- …earlier changes not shown

[Full history](https://skmtc.dev/orq-ai/apis/orq-ai-api/changes/v2/management-keys/:management_key_id/patch.md)

---

[API](https://skmtc.dev/orq-ai/apis/orq-ai-api.md) · [All operations](https://skmtc.dev/orq-ai/apis/orq-ai-api/llms.txt) · [OpenAPI document](https://skmtc.dev/orq-ai/apis/orq-ai-api/revisions/54ff1227abb6?raw)