Sign in

v3

latestOpenAPI 3.1.0Proprietary2026-08-07266348629.6 KB
Project Keys

Update Project Key

Update a Project Key's name, description, roles, tool scoping, or Kafka ACLs.

Supports additive capability transitions:

  • Send kafka_config on an API-only PK to add Kafka access. Response will include new_kafka_credentials with the plaintext Kafka password (shown once).
  • Send role_ids or permission_ids on a Kafka-only PK to add API credentials. Response will include new_api_credentials with the plaintext client_secret (shown once).

Returns 400 if the key is in creating/deleting/delete_failed state. role_ids and permission_ids are mutually exclusive.

patch/project-keys/{project_key_id}

Path parameters

project_key_idstring required

Request body

namestring nullable

Updated name

descriptionstring nullable

Updated description (HTML sanitized)

role_idsstring[] nullable

Change the Frontegg roles for this PK, or assign roles when adding API access to a Kafka-only PK. Note: changing roles on an existing API credential only takes effect when the current JWT expires. See token_ttl_seconds in the detail response for the validity window.

permission_idsstring[] nullable

Assign fine-grained permissions when ADDING API access to a Kafka-only PK. Changing permissions on an existing API credential is NOT supported - to change permissions on an existing PK, either switch to role_ids or delete and recreate the PK. This field is only accepted when the PK has no api_client_id yet.

whitelist_ipsstring nullable
kafka_passwordstring nullable

Rotate the Kafka SASL password for an existing Kafka user. PK must have kafka_username.

tool_profile'full' | 'read-only' | 'agent-operator' | 'infra-admin'
allowed_toolsstring[] nullable
blocked_toolsstring[] nullable

Response

Successful Response

idstring required
namestring required
descriptionstring nullable
created_atstring date-time nullable
api_client_idstring nullable
api_client_id_masked_secretstring nullable
kafka_usernamestring nullable
service_idstring required
statusstring required
last_used_atstring date-time nullable
tool_profile'full' | 'read-only' | 'agent-operator' | 'infra-admin'
allowed_toolsstring[] nullable
blocked_toolsstring[] nullable
agentic_enabledboolean

Whether this Project Key is wired up as the auth blob behind the Streamkap MCP. Toggled via POST /project-keys/{id}/enable-agentic and disable-agentic. When true, the encrypted credential lives on the PK row (server-side only); the agent picker on the FE filters to PKs where this is true.

agentic_secret_blobstring nullable

Always masked to '********' on responses when agentic_enabled is true; null otherwise. Server-derived only - PUT/PATCH bodies that include this field are rejected with 422.

token_ttl_secondsinteger

Current Frontegg JWT TTL in seconds (dynamic). Used by the frontend to compute how long role changes take to propagate.

warningsstring[]

Non-blocking informational messages the frontend should surface to the user after the update (e.g. 'role changes take effect within X hours'). Empty list when there is nothing to warn about.