Update an API key
Rename a key, rewrite its description, or change its scopes in place. The token stays the same.
PATCH edits the key without reissuing it: the existing token keeps working, under whatever scopes you set. That makes scope changes instant across every caller holding the token, for better and for worse.
updateMask names the fields to touch, so the rest of the spec survives a partial payload. Without it, the fields you send are the fields that change.
What a PATCH cannot do
state is read-only here. Disable and enable are dedicated actions, and reissuing the token is rotate. If you widen a key’s scopes past your own, expect a denial: a key can only manage keys it dominates, as covered in managing keys with keys.
Related
API key scopes
resource:verb unlocks.Rotate an API key
Authorizations
Bearer authentication header of the form Bearer <token>, where <token> is your auth token.
Path Parameters
The workspace the API key belongs to (path).
"workspace_01HXKD2E5NQM3T9AYWCF133E3Q"
The API key to update.
"apikey_01HXKD2E5NQM3T9AYWCFCSPNQY"
Body
Response
OK
An API key. Every key belongs to exactly one workspace and is managed via the workspace-scoped API key routes. The only exception is the system-managed global account key, which spans all workspaces and is managed via the account global_api_key routes.
AccountResourceMetadata is used to represent a resource that is associated to an account but not to a workspace.
Configuration for an API key.
The current lifecycle state of the API key. Output only. Keys are created STATE_ENABLED; use the :disable and :enable actions to transition between states.
STATE_UNSPECIFIED, STATE_ENABLED, STATE_DISABLED