> ## Documentation Index
> Fetch the complete documentation index at: https://langwatch.ai/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# Update an API key

> Update an API key's name, description, permission mode, permissions or bindings. Every field is optional; bindings are replaced outright, and the response is exactly what a subsequent GET returns. You may update your own keys; organization admins may update any key in the organization. Bindings can never exceed the access of the member the key belongs to. The token itself never changes.



## OpenAPI

````yaml PATCH /api/api-keys/{id}
openapi: 3.1.0
info:
  title: LangWatch API
  version: 1.0.0
  description: LangWatch openapi spec
servers:
  - url: https://app.langwatch.ai
security:
  - project_api_key: []
paths:
  /api/api-keys/{id}:
    patch:
      summary: Update an API key
      description: >-
        Update an API key's name, description, permission mode, permissions or
        bindings. Every field is optional; bindings are replaced outright, and
        the response is exactly what a subsequent GET returns. You may update
        your own keys; organization admins may update any key in the
        organization. Bindings can never exceed the access of the member the key
        belongs to. The token itself never changes.
      operationId: updateApiKey
      parameters:
        - name: id
          in: path
          required: true
          schema:
            type: string
          description: API key ID
      requestBody:
        content:
          application/json:
            schema:
              type: object
              properties:
                name:
                  type: string
                  minLength: 1
                  maxLength: 100
                description:
                  type:
                    - string
                    - 'null'
                  maxLength: 500
                permissionMode:
                  type: string
                  enum:
                    - all
                    - readonly
                    - restricted
                  description: >-
                    'all' and 'readonly' take their meaning from the bindings
                    alone; 'restricted' additionally requires an explicit
                    permissions list.
                permissions:
                  type: array
                  items:
                    type: string
                  description: >-
                    Restricted mode only: the exact resource:action permissions
                    the key's CUSTOM bindings grant.
                bindings:
                  type: array
                  items:
                    type: object
                    properties:
                      role:
                        type: string
                        enum:
                          - ADMIN
                          - MEMBER
                          - VIEWER
                          - CUSTOM
                        description: >-
                          CUSTOM grants exactly the listed permissions and
                          requires permissionMode 'restricted'.
                      scopeType:
                        type: string
                        enum:
                          - ORGANIZATION
                          - TEAM
                          - PROJECT
                      scopeId:
                        type: string
                        minLength: 1
                    required:
                      - role
                      - scopeType
                      - scopeId
                  minItems: 1
                  maxItems: 20
                  description: >-
                    Replaces the key's bindings outright. Whatever is accepted
                    here is exactly what a subsequent GET returns.
      responses:
        '200':
          description: The updated API key
          content:
            application/json:
              schema:
                type: object
                properties:
                  id:
                    type: string
                  name:
                    type: string
                  description:
                    type: string
                    nullable: true
                  keyType:
                    type: string
                    enum:
                      - personal
                      - service
                  assignedToUserId:
                    type: string
                    nullable: true
                    description: The member who owns the key; null for a service key.
                  createdByUserId:
                    type: string
                    nullable: true
                  permissionMode:
                    type: string
                    enum:
                      - all
                      - readonly
                      - restricted
                  permissions:
                    type: array
                    items:
                      type: string
                    description: >-
                      The resource:action permissions a restricted key grants.
                      Empty for the other modes.
                  createdAt:
                    type: string
                    format: date-time
                  expiresAt:
                    type: string
                    format: date-time
                    nullable: true
                  lastUsedAt:
                    type: string
                    format: date-time
                    nullable: true
                  revokedAt:
                    type: string
                    format: date-time
                    nullable: true
                  roleBindings:
                    type: array
                    items:
                      type: object
                      properties:
                        id:
                          type: string
                        role:
                          type: string
                          enum:
                            - ADMIN
                            - MEMBER
                            - VIEWER
                            - CUSTOM
                        scopeType:
                          type: string
                          enum:
                            - ORGANIZATION
                            - TEAM
                            - PROJECT
                        scopeId:
                          type: string
                  bindings:
                    type: array
                    items:
                      type: object
                      properties:
                        role:
                          type: string
                          enum:
                            - ADMIN
                            - MEMBER
                            - VIEWER
                            - CUSTOM
                        scopeType:
                          type: string
                          enum:
                            - ORGANIZATION
                            - TEAM
                            - PROJECT
                        scopeId:
                          type: string
        '401':
          description: Invalid or missing API key token
        '403':
          description: >-
            Insufficient permissions (requires organization:manage), the
            requested binding exceeds the key owner's own permissions, or the
            scope does not belong to this organization (api_key_scope_violation)
        '404':
          description: API key not found, or not yours to edit (api_key_not_found)
        '409':
          description: API key is already revoked (api_key_already_revoked)
        '422':
          description: >-
            Validation error, for example restricted mode without a permissions
            list (validation_error)
      security:
        - admin_api_key: []
components:
  securitySchemes:
    project_api_key:
      type: apiKey
      in: header
      name: X-Auth-Token
      description: >-
        Project API key for sending traces and accessing project-scoped
        resources. Format: sk-lw-... (no underscore). Obtain one by creating a
        project via the Admin API or the LangWatch UI.
    admin_api_key:
      type: http
      scheme: bearer
      description: >-
        Admin API key for organization-level operations (managing projects, API
        keys). Create one in Settings > API Keys or via POST /api/api-keys.
        Format: sk-lw-{id}_{secret}.

````