Sign in

v1

OpenAPI 3.1.0Proprietary2026-07-13197242444.9 KB
Project Keys

Update Project Key

Update a Project Key's name, description, roles, tool scoping, or Kafka ACLs.

Supports additive capability transitions:

  • Send kafka_config on an API-only PK to add Kafka access. Response will include new_kafka_credentials with the plaintext Kafka password (shown once).
  • Send role_ids or permission_ids on a Kafka-only PK to add API credentials. Response will include new_api_credentials with the plaintext client_secret (shown once).

Returns 400 if the key is in creating/deleting/delete_failed state. role_ids and permission_ids are mutually exclusive.

patch/project-keys/{project_key_id}

Path parameters

project_key_idstring required

Request body

namestring nullable

Updated name

descriptionstring nullable

Updated description (HTML sanitized)

role_idsstring[] nullable

Change the Frontegg roles for this PK, or assign roles when adding API access to a Kafka-only PK. Note: changing roles on an existing API credential only takes effect when the current JWT expires. See token_ttl_seconds in the detail response for the validity window.

permission_idsstring[] nullable

Assign fine-grained permissions when ADDING API access to a Kafka-only PK. Changing permissions on an existing API credential is NOT supported — to change permissions on an existing PK, either switch to role_ids or delete and recreate the PK. This field is only accepted when the PK has no api_client_id yet.

whitelist_ipsstring nullable
kafka_passwordstring nullable

Rotate the Kafka SASL password for an existing Kafka user. PK must have kafka_username.

tool_profile'full' | 'read-only' | 'agent-operator' | 'infra-admin'
allowed_toolsstring[] nullable
blocked_toolsstring[] nullable

Response

Successful Response

idstring required
namestring required
descriptionstring nullable
created_atstring date-time nullable
api_client_idstring nullable
api_client_id_masked_secretstring nullable
kafka_usernamestring nullable
service_idstring required
statusstring required
last_used_atstring date-time nullable
tool_profile'full' | 'read-only' | 'agent-operator' | 'infra-admin'
allowed_toolsstring[] nullable
blocked_toolsstring[] nullable
token_ttl_secondsinteger

Current Frontegg JWT TTL in seconds (dynamic). Used by the frontend to compute how long role changes take to propagate.

warningsstring[]

Non-blocking informational messages the frontend should surface to the user after the update (e.g. 'role changes take effect within X hours'). Empty list when there is nothing to warn about.