Update Api Key

Update an API key’s metadata or permissions.

🔒 The “admin-key” is protected and cannot be modified.

PATCH /v1/organizations/users/{user_email}/api-keys/{key_name}

Update Api Key

cURL

curl --request PATCH \
  --url https://api.mixpeek.com/v1/organizations/users/{user_email}/api-keys/{key_name} \
  --header 'Authorization: Bearer <token>' \
  --header 'Content-Type: application/json' \
  --data '
{
  "name": "<string>",
  "description": "<string>",
  "permissions": [],
  "scopes": [
    {
      "description": "Full namespace access (data + infrastructure)",
      "resource_id": "ns_production",
      "resource_type": "namespace"
    }
  ],
  "rate_limit_override": 2,
  "expires_at": "2023-11-07T05:31:56Z",
  "allowed_origins": [
    "https://docs.example.com",
    "https://*.example.com"
  ]
}
'

200

{
  "created_at": "2025-01-01T00:00:00Z",
  "created_by": "usr_admin",
  "description": "Service account for ingestion",
  "internal_id": "int_x1y2z3",
  "key_hash": "2c26b46b68ffc68ff99b453c1d304134",
  "key_id": "key_a1b2c3d4e5f6g7h",
  "key_prefix": "sk_abc123...",
  "name": "backend-service",
  "organization_id": "org_demo123",
  "permissions": [
    "read",
    "write"
  ],
  "scopes": [],
  "status": "active",
  "user_id": "usr_a1b2c3d4e5f6g7h"
}

Authorizations

Authorization · string · header · required

Mixpeek API key, sent as Authorization: Bearer mxp_sk_.... Create one in Studio under Settings → API Keys, or with an admin key via POST /v1/organizations/users/{user_email}/api-keys. A missing, malformed, unknown, revoked, inactive or expired key returns 401; a key without the permission, scope or plan an operation needs returns 403.

Path Parameters

user_email · string · required

key_name · string · required

Body

application/json

Keys this body does not declare are refused with 422 extra_forbidden naming the accepted keys (since 2026-11-02).

Partial update payload for an API key.

name · string | null

New key label.

Required string length: 1 - 100

description · string | null

Updated description for the key.

Maximum string length: 500

permissions · enum<string>[] | null

Replace existing permissions with the provided list.

Simplified API key permissions.

This four-value enum replaces the legacy 16-permission model. Keep usage simple: prefer the least privileged option that satisfies the workflow.

Hierarchy (strongest -> weakest): ADMIN > DELETE > WRITE > READ.

Available options: read, write, delete, admin

scopes · ResourceScope · object[] | null

Replace existing scopes. Use empty list for global access.

Show child attributes

rate_limit_override · integer | null

Updated per-key rate limit override.

Required range: x >= 1

expires_at · string<date-time> | null

New expiration timestamp. Use null to remove expiration.

status · enum<string> | null

Manually set key status (e.g. revoke).

Available options: active, revoked, expired

allowed_origins · string[] | null

Replace the key's allowed HTTP origins. Supports exact matches and wildcard subdomains (e.g., 'https://*.example.com'). Use an empty list to remove the origin restriction.

Example:

[
  "https://docs.example.com",
  "https://*.example.com"
]

Response

200

application/json

Successful Response

API key document stored in MongoDB.

key_hash · string · required

SHA-256 hash of the plaintext key.

internal_id · string · required

Organization internal identifier.

user_id · string · required

Identifier of the user who owns the key.

name · string · required

Human-friendly key label.

key_id · string

Public identifier for the API key.

key_prefix · string | null

Visible prefix of the API key for user identification (e.g., 'sk_abc123...'). Shows the first 10 characters of the plaintext key to help users identify which key is which in lists, without exposing the full secret. This follows industry best practices from GitHub, Stripe, and AWS. Generated automatically for new keys. Older keys may not have this field.

Maximum string length: 64

Example:

"sk_abc123..."

key_type · enum<string> · default: standard

Type of API key. STANDARD for regular organization keys, MARKETPLACE_SUBSCRIPTION for marketplace subscription access tokens.

Available options: standard, marketplace_subscription, retriever, user_scoped, session, workload

subscription_id · string | null

Marketplace subscription ID if this is a marketplace subscription key. Only set when key_type is MARKETPLACE_SUBSCRIPTION.

is_internal · boolean · default: false

SERVER-VERIFIED internal-actor marker. When True, this key belongs to Mixpeek's own operations (e.g. the in-org ops/health probe that must authenticate under a dedicated tenant's internal_id because the single-tenant pod gate fail-closes cross-org auth) and its usage is NOT billed to the org: accrue_mvs_usage skips the accrual and consume_credits skips the direct charge. FAIL CLOSED — absent/False means BILL. This is the ONLY server-side source a billing skip may key on; never the client-influenced X-Mixpeek-Traffic header or mixpeek-loop-* User-Agent. Set only by an admin provisioning an internal key, never from a create request.

organization_id · string | null

Organization public identifier (denormalized).

description · string · default: ""

Optional description explaining the key usage.

permissions · enum<string>[]

Permissions granted to the key.

Simplified API key permissions.

This four-value enum replaces the legacy 16-permission model. Keep usage simple: prefer the least privileged option that satisfies the workflow.

Hierarchy (strongest -> weakest): ADMIN > DELETE > WRITE > READ.

Available options: read, write, delete, admin

scopes · ResourceScope · object[]

Resource-level scopes restricting the key.

Show child attributes

rate_limit_override · integer | null

Optional per-key rate limit override in requests per minute.

status · enum<string> · default: active

Lifecycle status of the key (active, revoked, expired).

Available options: active, revoked, expired

expires_at · string<date-time> | null

UTC timestamp when the key automatically expires.

last_used_at · string<date-time> | null

UTC timestamp of the last successful request using the key.

created_at · string<date-time>

UTC timestamp when the key was created.

created_by · string | null

User identifier that created the key.

revoked_at · string<date-time> | null

UTC timestamp when the key was revoked (if applicable).

revoked_by · string | null

User identifier that revoked the key (if applicable).

allowed_origins · string[] | null

Optional list of allowed HTTP origins for this API key. When set, requests must include an Origin header matching one of these values. Supports exact matches (e.g., 'https://docs.example.com') and wildcard subdomains (e.g., 'https://*.example.com'). Only enforced for browser requests (defense-in-depth, not a security boundary). Null means no origin restriction.

Example:

[
  "https://docs.example.com",
  "https://*.example.com"
]

principal_id · string | null

End-user identifier for document-level ACL (row-level security). When set, this key is user-scoped: all document reads are automatically filtered to documents the principal owns or has been granted access to. This represents an end-user in your application, NOT an org user.