---
title: "Update API key"
method: PATCH
path: "/api-keys/{apiKeyId}"
tags: ["Account"]
---

# Update API key

`PATCH /api-keys/{apiKeyId}`

Renames a company-scoped API key and/or replaces its permissions in place. The caller must have the `api_keys:manage` permission. The key value is unchanged. Added permissions apply on the next retry; removed permissions may remain usable for up to five minutes while API caches expire. `preset` and `scopes` replace the whole selection rather than merging into it. The response contains non-secret metadata only.

## Path parameters

- `apiKeyId` string, required

## Request body

- object — Provide at least one of name, preset, or scopes.
  - `name` string — New human-readable key name.
  - `preset` 'full_access' | 'read_only' | 'agent_safe' | 'ai_drafting' | 'data_ingest_safe' | 'data_ingest_automations' | 'transactional_sender' | 'marketing_sender' — Replacement permission preset. Full-access keys are stored with scopes set to null, meaning all current and future permissions.
  - `scopes` string[] — Replacement explicit permission scopes. Overrides preset when provided.

## Response `200`

API key updated

- object
  - `success` boolean, required
  - `apiKey` ApiKeyMetadata, required — Non-secret metadata for a company-scoped API key. Plain key values and stored hashes are never returned.
    - `id` string, required
    - `name` string, required
    - `prefix` string, required — Non-secret key prefix for identifying the credential.
    - `type` 'company', required
    - `scopes` string[], nullable, required — Explicit permission scopes, or null for full access.
    - `permissions` object, required — Effective permission receipt for the key.
    - `deviceName` string, nullable, required
    - `lastUsedAt` string, date-time, nullable, required
    - `createdAt` string, date-time, required
    - `updatedAt` string, date-time, required
    - `isCurrent` boolean, required — Whether this is the credential authenticating the request.
  - `message` string, required

## Other responses

- `400` — Nothing to update, or an invalid permission preset or scope list
- `401` — Unauthorized
- `403` — Missing required API key management permission
- `404` — API key not found for the selected company

---

[API](https://skmtc.net/sequenzy/apis/sequenzy-api.md) · [All operations](https://skmtc.net/sequenzy/apis/sequenzy-api/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/sequenzy/sequenzy-api/versions/af1cf9620482/schema)