---
title: "Update Steep Key"
method: PATCH
path: "/api/v1/steep-keys/{key_id}"
tags: ["authed"]
---

# Update Steep Key

`PATCH /api/v1/steep-keys/{key_id}`

## Request

- Base URL: `https://api.teaflask.com` (the document declares no server; this is the origin it was published from)
- URL: `https://api.teaflask.com/api/v1/steep-keys/{key_id}`
- Auth: none declared

Change a key's settings. Capture changes reach pages on their next
config fetch; a retention change applies to journeys already stored. A
revoked key takes only retention and label changes.

## Path parameters

- `key_id` string, uuid, required

## Request body

- UpdateSteepKeyRequest: A partial edit: only the settings present change. Only the label takes null, which clears it; null for any other setting is refused.
  - `allowed_origins` string[]: Every web origin to capture journeys on.
  - `label` string, nullable: A name to tell keys apart; null clears it.
  - `capture_outlines` boolean: Keep an outline of each page's structure.
  - `capture_typed_values` boolean: Keep what users type into fields.
  - `capture_address_ids` boolean: Keep ids in page, link and request addresses; secret-looking segments stay masked.
  - `capture_query_values` boolean: Keep the query values of the addresses your app requests, after redaction. Needs typed values.
  - `capture_request_bodies` boolean: Keep what your app sends with a request (JSON, form or text, up to 2 KB), after redaction. Needs typed values.
  - `capture_response_bodies` boolean: Keep what the server answers to requests users start, writes, failures and slow calls (JSON or text, up to 2 KB), after redaction. Needs page outlines.
  - `respect_privacy_signals` boolean: Leave browsers sending Global Privacy Control uncaptured.
  - `signed_in_only` boolean: Capture only signed-in users' journeys.
  - `retention_days` integer: How many days to keep journeys, including those already stored.
  - `ignore_selectors` string[]: CSS selectors whose elements are never captured.

## Response `200`

Successful Response

- SteepKeyResponse: A Steep key: everything needed to recognize, configure and install it.
  - `id` string, uuid, required: The key's id; rotation keeps it.
  - `label` string, nullable, required: A name to tell keys apart, if given.
  - `key` string, required: The full Steep key, safe in page source: it names the workspace and grants nothing on its own.
  - `key_prefix` string, required: The key's first characters, to recognize it.
  - `mode` 'live' | 'test', required
  - `status` 'active' | 'revoked', required
  - `allowed_origins` string[], required: The only web origins the key captures journeys from.
  - `capture_outlines` boolean, required: Whether journeys keep an outline of each page's structure.
  - `capture_typed_values` boolean, required: Whether journeys keep what users typed into fields.
  - `capture_address_ids` boolean, required: Whether journeys keep ids in page, link and request addresses; secret-looking segments stay masked.
  - `capture_query_values` boolean, required: Whether journeys keep the query values of the addresses the app requests, after redaction; needs typed values.
  - `capture_request_bodies` boolean, required: Whether journeys keep what the app sends with a request (JSON, form or text, up to 2 KB), after redaction; needs typed values.
  - `capture_response_bodies` boolean, required: Whether journeys keep what the server answers to requests users start, writes, failures and slow calls (JSON or text, up to 2 KB), after redaction; needs page outlines.
  - `respect_privacy_signals` boolean, required: Whether a browser sending Global Privacy Control is left uncaptured.
  - `signed_in_only` boolean, required: Whether only signed-in users' journeys are captured.
  - `retention_days` integer, required: How many days journeys are kept.
  - `ignore_selectors` string[], required: CSS selectors whose elements are never captured.
  - `capture_version` integer, required: Moves whenever a capture setting changes, so pages pick up the new settings.
  - `created_at` string, date-time, required: When the key was created.
  - `rotated_at` string, date-time, nullable, required: When the key was last rotated; null if never.
  - `revoked_at` string, date-time, nullable, required: When the key was revoked; null while it is active.
  - `last_event_at` string, date-time, nullable, required: When the key last delivered an event; null until then.

## Other responses

- `401`: Unauthorized
- `403`: Forbidden
- `404`: Not found
- `405`: Method not allowed
- `422`: Validation error
- `500`: Internal server error

## Changes

- **2026-11-03** `c6ac9fd6657f`: 1 warning, 6 info
  - removed the optional property `rich_capture_available` from the response with the `200` status
  - removed the `STEEP_LEARNING_DISABLED` enum value from the `error/code` response property for the response status `401`
  - removed the `STEEP_LEARNING_DISABLED` enum value from the `error/code` response property for the response status `403`
  - removed the `STEEP_LEARNING_DISABLED` enum value from the `error/code` response property for the response status `404`
  - …3 more

[Operation history](https://skmtc.dev/teaflask/apis/teaflask-api/changes/api/v1/steep-keys/:key_id/patch.md)

---

[API](https://skmtc.dev/teaflask/apis/teaflask-api.md) - [All operations](https://skmtc.dev/teaflask/apis/teaflask-api/llms.txt) - [OpenAPI document](https://skmtc.dev/teaflask/apis/teaflask-api/revisions/c6ac9fd6657f?raw)