api-keys

Update Api Key

Admins may edit any key in the org. A MEMBER may rename their OWN key — and nothing else.

WHY NAME-ONLY, and why this is not a one-liner: ApiKeyPatchIn can change scopes. Opening PATCH to a key's owner without replaying the mint ceiling would let a member create a legitimate mcp:* key and then PATCH it to project:write — a back-door escalation past a create endpoint that refuses exactly that. name is the only field with no vector, and it is the real member need: finding your own key again.

env_type and the allowlists are refused too, not because renaming is risky but because dev keys reach the runtime endpoint under allowlist control — unreviewed reach is reach. Changing a key's PROJECTS stays admin-only on its own route, which would otherwise bypass not_a_member_of_project.

patch/v1/orgs/{org_id}/api-keys/{key_id}

Request

  • Base URL: https://api.sonenta.dev
  • URL: https://api.sonenta.dev/v1/orgs/{org_id}/api-keys/{key_id}
  • Auth: none declared

Path parameters

key_idstring required
org_idstring required

Request body

namestring nullable
scopesstring[] nullable
env_type'prod' | 'dev' nullable
ip_allowliststring[] nullable
origin_allowliststring[] nullable

Response

Successful Response

uuidstring required
prefixstring required
last4string required
namestring required
scopesstring[] required
projectsstring[]
org_wideboolean
version_uuidstring nullable
env_type'prod' | 'dev'
ip_allowliststring[]
origin_allowliststring[]
created_by_uuidstring nullable required
created_atstring date-time required
expires_atstring date-time nullable required
revoked_atstring date-time nullable required
last_used_atstring date-time nullable required

Changes

No recorded changes to this operation across all 1 revision of this API.