PATCH /v1/keys/{id}

Call	PATCH /v1/keys/{id}
Price	free
Scope	keys:manage
Operation id	updateKey

What it does

Change a key’s name, scopes or limits (rate limit, daily spend cap, IP allowlist, expiry) without rotating it; the secret is unchanged. A key can only grant scopes it holds itself. Takes effect on the next request. Audited (key_scopes_changed for scopes, key_updated for the rest). Free. Scope: keys:manage.

Example request

Copy it as curl. Set VERDICT_API_KEY first; uuidgen makes a fresh Idempotency-Key.

Request

curl -X PATCH 'https://api.askverdict.io/v1/keys/key_01JC3Z4Y8R9K2M5N7P1Q3S5T7V' \
  -H "Authorization: Bearer $VERDICT_API_KEY" \
  -H 'Content-Type: application/json' \
  -d '{
  "scopes": [
    "decisions:write",
    "index:read"
  ],
  "rate_limit_per_minute": 120
}'

Example response

200: The key, updated.

200 response

{
  "id": "key_01JC3Z4Y8R9K2M5N7P1Q3S5T7V",
  "project_id": "prj_01JC3Z4Y8R9K2M5N7P1Q3S5T7V",
  "name": "outbound-agent prod",
  "environment": "live",
  "prefix": "vd_live_Ab12Cd",
  "scopes": [
    "decisions:write",
    "index:read"
  ],
  "status": "active",
  "rate_limit_per_minute": 120,
  "daily_spend_cap_usd": 25,
  "ip_allowlist": [],
  "expires_at": null,
  "last_used_at": "2026-11-07T14:03:00Z",
  "created_at": "2026-11-01T09:00:00Z"
}

Parameters

Name	In	Type	Required	Description
id	path	string	yes	The key id.
x-verdict-version	header	string	no	API version to use, a date. Defaults to the version current when the key was created. The current version is 2026-11-01.

Request body

Schema UpdateKeyRequest. Fields to change.

Field	Type	Required	Description
name	string	no	New name.
scopes	array of enum: “decisions:write”, “index:read”, “outcomes:write”, “watches:manage”, “vendors:call”, “account:read”, “account:manage”, “keys:manage”	no	Replacement scopes. A key can only grant scopes the calling key holds itself. Audited as key_scopes_changed.
rate_limit_per_minute	integer	no	Requests per minute.
daily_spend_cap_usd	number or null	no	Daily spend cap; null removes it. US dollars, up to 6 decimals.
ip_allowlist	array of string (ipv4-cidr) or string (ipv6-cidr)	no	CIDR blocks the key may be used from; empty means anywhere.
expires_at	string or null (date-time)	no	Expiry; null removes it.

Response fields (200)

Schema ApiKey.

Field	Type	Required	Description
id	string	yes	The key id.
project_id	string	yes	Project the key belongs to.
name	string	yes	Name.
environment	enum: “live”, “test”	yes	live or test.
prefix	string	yes	The key’s first characters, to recognize it.
scopes	array of enum: “decisions:write”, “index:read”, “outcomes:write”, “watches:manage”, “vendors:call”, “account:read”, “account:manage”, “keys:manage”	yes	Scopes granted.
status	enum: “active”, “rotating”, “revoked”, “expired”	yes	Lifecycle status.
rate_limit_per_minute	integer	yes	Requests per minute allowed.
daily_spend_cap_usd	number or null	yes	Daily spend cap, or null for none. US dollars, up to 6 decimals.
ip_allowlist	array of string	yes	CIDR blocks the key may be used from; empty means anywhere.
expires_at	string or null (date-time)	yes	Expiry, or null for none.
last_used_at	string or null (date-time)	yes	Last successful use, or null.
created_at	string (date-time)	yes	When the key was created.

Errors

Errors are RFC 9457 problem details and are never billed. Branch on type. See Errors.

Status	Meaning
400	Invalid request: malformed JSON, an unknown field, a failed constraint or a size limit (invalid_request).
401	Missing, malformed, revoked or expired API key, or a bad webhook signature (unauthorized).
403	The key lacks the scope this operation needs (forbidden_scope).
404	The resource does not exist in this organization (not_found).
409	The Idempotency-Key was reused with a different request, or the first request is still running (idempotency_conflict).
429	Rate limited (rate_limited). Wait Retry-After seconds.
500	Unexpected server error (internal). Not billed; retry with the same Idempotency-Key.

Try it

Open the interactive reference to send this request from the browser. The full document is at /openapi.json.