---
title: "Update an API key's project binding and limits (owner/admin)"
method: PATCH
path: "/v1/orgs/{org_id}/api-keys/{key_id}"
tags: ["api-keys"]
---

# Update an API key's project binding and limits (owner/admin)

`PATCH /v1/orgs/{org_id}/api-keys/{key_id}`

## Request

- Base URL: `https://api.wavehouse.cloud`
- URL: `https://api.wavehouse.cloud/v1/orgs/{org_id}/api-keys/{key_id}`
- Auth: one of:
  - API key in cookie `whc_session`
  - HTTP bearer

## Path parameters

- `org_id` string, required
- `key_id` string, required

## Request body

- UpdateAPIKeyInput
  - `all_projects` boolean: grant the key access to EVERY project in the org; else set project_ids
  - `limits` string[]: replacement limit set; omit to keep the current one, [] to clear it
  - `project_ids` string[]: replacement project-id allow-list; required unless all_projects=true or only limits change

## Response `200`

OK

- APIKeyView
  - `all_projects` boolean, required: true = the key may touch every project in the org
  - `created_at` string, date-time, required
  - `created_by` string, required: user id that created the key
  - `id` string, required
  - `key_prefix` string, required: the key's first 14 characters (whc_key_ + 6), to tell keys apart
  - `last4` string, required: the key's last four characters
  - `last_used_at` string, date-time: absent until first authenticated use; updated at most once a minute
  - `limits` string[], required: what the key may not do even where its role could; empty = only its role applies
  - `name` string, required
  - `project_ids` string[], required: the project id(s) the key may touch (empty when all_projects)
  - `role` string, required: org role the key acts as (admin | member)

## Other responses

- `429`: Rate limited, per client IP, API key or org; a client IP is also refused on every route for a while after repeated authentication failures. A limited operation carries RateLimit-Policy and RateLimit on every response; wait Retry-After seconds before retrying.
- `default`: Error

---

[API](https://skmtc.dev/wavehouse/apis/wavehouse-cloud-api.md) · [All operations](https://skmtc.dev/wavehouse/apis/wavehouse-cloud-api/llms.txt) · [OpenAPI document](https://skmtc.dev/wavehouse/apis/wavehouse-cloud-api/revisions/adea029bf505?raw)