---
title: "Update Project Key"
method: PATCH
path: "/project-keys/{project_key_id}"
tags: ["Project Keys"]
---

# Update Project Key

`PATCH /project-keys/{project_key_id}`

Update a Project Key's name, description, roles, tool scoping, or Kafka ACLs.

Supports additive capability transitions:
- Send `kafka_config` on an API-only PK to add Kafka access. Response will include
  `new_kafka_credentials` with the plaintext Kafka password (shown once).
- Send `role_ids` or `permission_ids` on a Kafka-only PK to add API credentials.
  Response will include `new_api_credentials` with the plaintext client_secret (shown once).

Returns 400 if the key is in creating/deleting/delete_failed state.
role_ids and permission_ids are mutually exclusive.

## Path parameters

- `project_key_id` string, required

## Request body

- ProjectKeyUpdateRequest — Request body for updating a Project Key.
  - `name` string, nullable — Updated name
  - `description` string, nullable — Updated description (HTML sanitized)
  - `role_ids` string[], nullable — Change the Frontegg roles for this PK, or assign roles when adding API access to a Kafka-only PK. Note: changing roles on an existing API credential only takes effect when the current JWT expires. See token_ttl_seconds in the detail response for the validity window.
  - `permission_ids` string[], nullable — Assign fine-grained permissions when ADDING API access to a Kafka-only PK. Changing permissions on an existing API credential is NOT supported - to change permissions on an existing PK, either switch to role_ids or delete and recreate the PK. This field is only accepted when the PK has no api_client_id yet.
  - `kafka_acls` KafkaAclModel[], nullable
    - `topic_name` string, required
    - `operation` string, required
    - `resource_pattern_type` string, required
    - `resource` string
  - `whitelist_ips` string, nullable
  - `kafka_config` ProjectKeyKafkaConfig — Kafka user configuration for a Project Key.
    - `username` string, required — Kafka username (alphanumeric + hyphens, 3-24 chars)
    - `password` string, required — Kafka SASL password (12-128 chars)
    - `whitelist_ips` string, nullable — Comma-separated IP addresses or CIDR ranges
    - `kafka_acls` KafkaAclModel[] — Kafka ACL rules for topic/group access control
      - `topic_name` string, required
      - `operation` string, required
      - `resource_pattern_type` string, required
      - `resource` string
    - `is_create_schema_registry` boolean — Whether to create a Schema Registry proxy
  - `kafka_password` string, nullable — Rotate the Kafka SASL password for an existing Kafka user. PK must have kafka_username.
  - `tool_profile` 'full' | 'read-only' | 'agent-operator' | 'infra-admin'
  - `allowed_tools` string[], nullable
  - `blocked_tools` string[], nullable

## Response `200`

Successful Response

- ProjectKeyUpdateResponse — Response for PATCH /project-keys/{id}. Extends the summary with plaintext secrets when an additive capability transition occurred. For regular updates (no capability change), both `new_api_credentials` and `new_kafka_credentials` are None.
  - `id` string, required
  - `name` string, required
  - `description` string, nullable
  - `created_at` string, date-time, nullable
  - `created_by_user` User
    - `id` string, required
    - `email` string, required
    - `name` string, required
    - `profile_picture_url` string, nullable
    - `phone_number` string, nullable
    - `tenant_id` string, required
    - `created_at` union
      - string
      - string, date-time
    - `last_login` union
      - string
      - string, date-time
  - `api_client_id` string, nullable
  - `api_client_id_masked_secret` string, nullable
  - `kafka_username` string, nullable
  - `service_id` string, required
  - `roles` Role[]
    - `id` string, required
    - `key` string, required
    - `name` string, required
    - `description` string, nullable, required
    - `created_at` union
      - string
      - string, date-time
    - `updated_at` union
      - string
      - string, date-time
    - `permissions` string[]
  - `status` string, required
  - `last_used_at` string, date-time, nullable
  - `tool_profile` 'full' | 'read-only' | 'agent-operator' | 'infra-admin'
  - `allowed_tools` string[], nullable
  - `blocked_tools` string[], nullable
  - `agentic_enabled` boolean — Whether this Project Key is wired up as the auth blob behind the Streamkap MCP. Toggled via POST /project-keys/{id}/enable-agentic and disable-agentic. When true, the encrypted credential lives on the PK row (server-side only); the agent picker on the FE filters to PKs where this is true.
  - `agentic_secret_blob` string, nullable — Always masked to '********' on responses when agentic_enabled is true; null otherwise. Server-derived only - PUT/PATCH bodies that include this field are rejected with 422.
  - `new_api_credentials` ProjectKeyApiCredentials — API credential section of the credential file.
    - `client_id` string, required
    - `client_secret` string, required
    - `token_endpoint` string, required
    - `api_url` string, required
    - `roles` string[]
  - `new_kafka_credentials` ProjectKeyKafkaCredentials — Kafka credential section of the credential file.
    - `username` string, required
    - `password` string, required
    - `bootstrap_servers` string, required
    - `security_protocol` string
    - `sasl_mechanism` string
    - `schema_registry_url` string, nullable
  - `token_ttl_seconds` integer — Current Frontegg JWT TTL in seconds (dynamic). Used by the frontend to compute how long role changes take to propagate.
  - `warnings` string[] — Non-blocking informational messages the frontend should surface to the user after the update (e.g. 'role changes take effect within X hours'). Empty list when there is nothing to warn about.

## Other responses

- `422` — Validation Error

---

[API](https://skmtc.net/streamkap/apis/streamkap-rest-api.md) · [All operations](https://skmtc.net/streamkap/apis/streamkap-rest-api/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/streamkap/streamkap-rest-api/versions/8aea6143d003/schema)