Update an API key

⚠️
Preview — this feature is being built; the design below is the spec.
PATCH https://app.syntic.ai/v1/organizations/api_keys/{api_key_id}

Rename a key, switch it off or on, change its origin or IP restrictions, or move its default API version. A key set to inactive fails with 401 inactive_api_key from the next request. Permanent revocation stays in the Console.

For how this fits into a full workflow, see API key management.

Headers

HeaderRequiredValue
AuthorizationYesBearer <admin key>: an Admin API key (sk_admin_...). Inference keys are refused with 403 admin_key_required. See Admin API keys.
syntic-betaYes, while in previewadmin-2026-11-01. Without it the call fails with 400 beta_required. See Versioning.
Content-TypeYesapplication/json

Path parameters

ParameterTypeDescription
api_key_idstringThe key’s id, starting with apikey_.

Body parameters

ParameterTypeRequiredNotes
namestringNo1 to 100 characters.
statusstringNoactive or inactive.
allowed_originsarray of stringsNoReplaces the list.
allowed_ipsarray of stringsNoReplaces the list.
pinned_versionstringNoA published syntic-version date.

Response

200 OK, Content-Type: application/json

{
  "id": "apikey_01JB7C9E1G3J5L7N9Q1S",
  "type": "api_key",
  "name": "billing-worker-prod",
  "kind": "private",
  "prefix": "sk_live_3f9c",
  "hint": "…a71e",
  "status": "inactive",
  "workspace_id": "wrkspc_01JC0A2C4E6G8J0L2N4Q",
  "created_by": {
    "id": "user_01J9Y0A2C4E6G8J0L2N4",
    "email": "dana@example.com",
    "status": "active"
  },
  "allowed_origins": [],
  "allowed_ips": [
    "203.0.113.0/24"
  ],
  "pinned_version": "2026-11-01",
  "expires_at": null,
  "created_at": "2026-03-02T09:30:00Z",
  "last_used_at": "2026-11-05T10:02:11Z",
  "last_used_ip": "203.0.113.40",
  "use_count": 1841220
}

Examples

curl -sS -X PATCH https://app.syntic.ai/v1/organizations/api_keys/apikey_01JB7C9E1G3J5L7N9Q1S \
  -H "Authorization: Bearer $SYNTIC_ADMIN_KEY" \
  -H "syntic-beta: admin-2026-11-01" \
  -H "Content-Type: application/json" \
  -d '{
      "status": "inactive"
    }'

Errors

Errors use the error envelope and carry a request_id. Codes specific to this operation:

StatustypecodeWhen
400invalid_request_errorbeta_requiredThe syntic-beta header is missing.
400invalid_request_errorinvalid_parameterA bad origin, IP range or version; param names it.
400invalid_request_errorread_only_fieldkind, workspace_id and the secret cannot be changed.
404not_found_errorapi_key_not_foundNo key with that id in the organization.
409conflict_errorkey_revokedThe key is revoked or expired.
401authentication_errorinvalid_api_keyThe admin key is missing, unknown, revoked or expired.
403permission_erroradmin_key_requiredAn inference key was used.
429rate_limit_errorrate_limitedToo many requests; wait for Retry-After. See Rate-limit headers.
Was this page helpful?