---
title: "Update zone"
method: PATCH
path: "/zones/{zoneId}"
tags: ["Zones"]
---

# Update zone

`PATCH /zones/{zoneId}`

Updates a zone's configuration (partial update)

## Path parameters

- `zoneId` string, required

## Request body

- IamZoneUpdate — Schema for updating an existing zone (partial update)
  - `name` string, safe-text — Human-readable name. Must not contain HTML tags (e.g. `<script>`, `<div>`) or control characters.
  - `description` string, safe-text, nullable — Human-readable description. Must not contain HTML tags (e.g. `<script>`, `<div>`) or control characters.
  - `requires_invitation` boolean — Whether the zone requires an invitation for email/password registration, only applies when user_identity_provider_id is not set
  - `user_identity_provider_id` string, nullable — Provider ID to configure for user login (set to null to unset)
  - `protocols` IamZoneProtocolUpdate, nullable — Protocol configuration update for a zone (partial update)
    - `oauth2` IamZoneOAuth2ProtocolUpdate — OAuth 2.0 protocol configuration update for a zone (partial update)
      - `pkce_required` boolean, nullable — Whether PKCE is required for authorization code flows
      - `dcr_enabled` boolean, nullable — Whether Dynamic Client Registration is enabled
      - `cimd` IamZoneCimd — Client ID Metadata Document auto-provisioning configuration
        - `enabled` boolean, required — Whether CIMD auto-provisioning is enabled for unregistered URL-based clients
        - `allowed_client_ids` string[], required — Allowlist for CIMD client_id URLs. Each entry is an exact URL, a wildcard origin with a single * replacing one subdomain label (e.g. https://*.example.com matches https://app.example.com but not https://a.b.example.com), or the literal * to allow any client. Only one * is permitted per entry.
  - `encryption_key` IamEncryptionKeyAwsKmsConfigUpdate, nullable — AWS KMS configuration for zone encryption update (set to null to remove customer-managed key and revert to default)
    - `type` 'aws', required
    - `arn` string, required — AWS KMS Key ARN for encrypting the zone's data
  - `default_mcp_gateway_application_id` string, nullable — Application ID configured as the default MCP Gateway for the zone (set to null to unset)
  - `default_resource_id` string, nullable — Resource ID to configure as the default resource for the zone (set to null to unset)

## Response `200`

A zone for organizing resources within an organization

- IamZone — A zone for organizing resources within an organization
  - `id` string, required — Unique identifier of the zone
  - `organization_id` string, required — Organization that owns this zone
  - `slug` string, required — URL-safe identifier, unique within the zone
  - `name` string, required — Human-readable name
  - `description` string, nullable — Human-readable description
  - `user_identity_provider_id` string — Provider ID configured for user login
  - `requires_invitation` boolean — Whether the zone requires an invitation for email/password registration, only applies when user_identity_provider_id is not set
  - `protocols` object, required — Protocol configuration for a zone
    - `oauth2` IamZoneOAuth2Protocol, required — OAuth 2.0 protocol configuration for a zone
      - `issuer` string, uri, required — OAuth 2.0 issuer identifier
      - `authorization_server_metadata` string, uri, required — OAuth 2.0 Authorization Server Metadata endpoint (.well-known/oauth-authorization-server)
      - `authorization_endpoint` string, uri, required — OAuth 2.0 authorization endpoint
      - `token_endpoint` string, uri, required — OAuth 2.0 token endpoint
      - `redirect_uri` string, uri, required — OAuth 2.0 redirect URI for this zone
      - `registration_endpoint` string, uri, required — OAuth 2.0 Dynamic Client Registration endpoint
      - `jwks_uri` string, uri, required — JSON Web Key Set endpoint
      - `pkce_required` boolean, required — Whether PKCE is required for authorization code flows
      - `dcr_enabled` boolean, required — Whether Dynamic Client Registration is enabled
      - `cimd` IamZoneCimd, required — Client ID Metadata Document auto-provisioning configuration
        - `enabled` boolean, required — Whether CIMD auto-provisioning is enabled for unregistered URL-based clients
        - `allowed_client_ids` string[], required — Allowlist for CIMD client_id URLs. Each entry is an exact URL, a wildcard origin with a single * replacing one subdomain label (e.g. https://*.example.com matches https://app.example.com but not https://a.b.example.com), or the literal * to allow any client. Only one * is permitted per entry.
    - `openid` IamZoneOpenIDProtocol, required — OpenID Connect protocol configuration for a zone
      - `provider_configuration` string, uri, required — OpenID Connect Provider Configuration endpoint (.well-known/openid-configuration)
      - `userinfo_endpoint` string, uri, required — OpenID Connect UserInfo endpoint
  - `encryption_key` IamEncryptionKeyAwsKmsConfig — AWS KMS configuration for zone encryption. When not specified, the default Keycard Cloud encryption key will be used.
    - `type` 'aws', required
    - `arn` string, required — AWS KMS Key ARN for encrypting the zone's data
  - `default_mcp_gateway_application_id` string — Application ID configured as the default MCP Gateway for the zone
  - `default_resource_id` string — Resource ID configured as the default resource for the zone
  - `permissions` IamPermissions — Permissions granted to the authenticated principal. Only populated when expand[]=permissions query parameter is provided. Keys are resource types, values are objects mapping action names to boolean values.
  - `owner_type` 'platform' | 'customer', required — Who owns this zone. Platform-owned zones cannot be modified via API.
  - `created_at` string, date-time, required — Entity creation timestamp
  - `updated_at` string, date-time, required — Entity update timestamp

## Other responses

- `default` — Error response

---

[API](https://skmtc.net/keycardai/apis/untitled-api.md) · [All operations](https://skmtc.net/keycardai/apis/untitled-api/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/keycardai/untitled-api/revisions/2f5033ed4491/schema)