Skip to main content
PATCH
Update an API key's name and/or IP allowlist

Authorizations

Authorization
string
header
required

Dairo API key, e.g. dairo_test_... or dairo_live_...

Path Parameters

apiKeyId
string
required

Body

application/json

At least one of name, allowedIps or inboxIds is required. scopes is deliberately absent: scopes are immutable after mint, and revoking is DELETE on this same path. Sending either is a 400 rather than a silently-ignored no-op.

name
string

New display name. Omit to leave it unchanged; null is rejected with 400 rather than silently ignored.

allowedIps
string[]

Replaces the whole allowlist; it never merges. Omit the field to leave the current allowlist unchanged, or pass an empty array to clear it so the key may authenticate from any IP. Entries are IPv4/IPv6 addresses or CIDR ranges (up to 50); deny-by-default, so a correct secret from an unlisted IP is rejected with 403. Explicit null is rejected with 400 — unlike on create it does not mean any IP here, and it used to be a silently-ignored no-op.

inboxIds
string<uuid>[]

Replaces the whole per-inbox restriction; it never merges. Omit to leave it unchanged, or pass an empty array to clear it so the key may send as any inbox. A restricted key may only ever narrow to a subset of its own inboxes — it cannot unpin itself or a sibling. Explicit null is rejected with 400: unlike on create it does not mean unrestricted here, it would change nothing.

Response

Success

id
string<uuid>
required
name
string
required
prefix
string
required
Example:

"dairo_test_abc123"

scopes
string[]
required
status
enum<string>
required
Available options:
active,
revoked
createdAt
string<date-time>
required
lastUsedAt
string<date-time> | null
allowedIps
string[] | null

The key's IP allowlist (IPv4/IPv6 addresses or CIDR ranges), or null when the key authenticates from any IP.

inboxIds
string<uuid>[] | null

The inbox ids (inboxes.id) this key may send as. Empty or null means the key is unrestricted and may send as any inbox in the project — the default, and what every key minted before this field existed has.