---
title: "Update Api Key"
method: PATCH
path: "/v1/orgs/{org_id}/api-keys/{key_id}"
tags: ["api-keys"]
---

# Update Api Key

`PATCH /v1/orgs/{org_id}/api-keys/{key_id}`

## Request

- Base URL: `https://api.sonenta.dev`
- URL: `https://api.sonenta.dev/v1/orgs/{org_id}/api-keys/{key_id}`
- Auth: none declared

Admins may edit any key in the org. A MEMBER may rename their OWN key —
and nothing else.

WHY NAME-ONLY, and why this is not a one-liner: `ApiKeyPatchIn` can change
`scopes`. Opening PATCH to a key's owner without replaying the mint ceiling
would let a member create a legitimate `mcp:*` key and then PATCH it to
`project:write` — a back-door escalation past a create endpoint that refuses
exactly that. `name` is the only field with no vector, and it is the real
member need: finding your own key again.

`env_type` and the allowlists are refused too, not because renaming is risky
but because `dev` keys reach the runtime endpoint under allowlist control —
unreviewed reach is reach. Changing a key's PROJECTS stays admin-only on its
own route, which would otherwise bypass `not_a_member_of_project`.

## Path parameters

- `key_id` string, required
- `org_id` string, required

## Request body

- ApiKeyPatchIn
  - `name` string, nullable
  - `scopes` string[], nullable
  - `env_type` 'prod' | 'dev', nullable
  - `ip_allowlist` string[], nullable
  - `origin_allowlist` string[], nullable

## Response `200`

Successful Response

- ApiKeyOut: Listing shape — no secret.
  - `uuid` string, required
  - `prefix` string, required
  - `last4` string, required
  - `name` string, required
  - `scopes` string[], required
  - `projects` string[]
  - `org_wide` boolean
  - `version_uuid` string, nullable
  - `env_type` 'prod' | 'dev'
  - `ip_allowlist` string[]
  - `origin_allowlist` string[]
  - `created_by_uuid` string, nullable, required
  - `created_at` string, date-time, required
  - `expires_at` string, date-time, nullable, required
  - `revoked_at` string, date-time, nullable, required
  - `last_used_at` string, date-time, nullable, required

## Other responses

- `422`: Validation Error

---

[API](https://skmtc.dev/sonenta/apis/sonenta-api.md) · [All operations](https://skmtc.dev/sonenta/apis/sonenta-api/llms.txt) · [OpenAPI document](https://skmtc.dev/sonenta/apis/sonenta-api/revisions/f853ea49fb05?raw)