Update API key
PUT/v2/config/admin/apikey/:apiKeyId
Updates the name, the scopes and the lifetime of an API key.
The service builds a new token on every update. The token that you had before the update stops working, so replace it in every client that uses it. The new lifetime starts at the moment of the update.
The service reads only name, scopes and expiryInDays from the request. It keeps the current name when name is absent or holds spaces only. It replaces the scopes with the list that you send.
This operation does not change the sandbox organisation of the key. To change it, use PUT /config/admin/apikey/{apiKeyId}/sandbox-org.
Request
Path Parameters
Unique ID of an object
- application/json
Body
required
The new values of the API key.
apiKey objectrequired
The new values of the API key.
New name of the API key. The service keeps the current name when you leave this field out or when you send a value of spaces only.
Possible values: [config, audit, service, onboard]
New scopes of the API key. The service replaces the current scopes with this list. It refuses any other value with HTTP 400.
Default value: 30
New lifetime of the API key in days, counted from the moment of the update. The service uses 30 days when you leave this field out, or when you send 0 or a negative value.
Responses
- 200
- 400
- 401
- 403
- 500
The service updated the API key. The apiKey field of the returned object holds the new signed token.
Response Headers
- application/json
- Schema
- Example (from schema)
- Example
Schema
apiKey objectrequired
The API key after the update.
Unique identifier of the API key.
Name of the API key. The service does not check this value for uniqueness.
Possible values: [config, audit, service, onboard]
Scopes of the API key. Each scope opens a group of endpoints. The service refuses any other value with HTTP 400.
The signed JSON Web Token. Send it as Authorization: ApiKey <apiKey>. The token holds the scopes, the organisation, the organisation administrator and, when the key is bound to a sandbox organisation, the sandbox organisation.
Default value: 30
Lifetime of the API key in days, counted from the moment the service created or last updated the key. The service uses 30 days when you send 0 or a negative value.
Moment when the service last wrote the API key, in UTC. The service sets this value on create and on every update, including the delete operation.
Moment when the API key expires, in UTC.
Possible values: [igrantio, aip10]
Type of the API key. The list operation returns only keys of type igrantio; these are the keys that you create with this group of operations.
Identifier of the sandbox organisation that the API key is bound to. The field is absent when the key belongs to the main wallet of the organisation.
createdBy objectrequired
The user who created the API key, and the moment of creation. The service keeps this as log metadata.
Identifier of the user who created the API key. The value is an empty string for a key created with an API key.
Email address of the user who created the API key.
Moment of creation, in UTC.
{
"apiKey": {
"id": "6889e1a4c5b2f30001a3d720",
"name": "Production issuance key",
"scopes": [
"config",
"service"
],
"apiKey": "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJTY29wZXMiOlsiY29uZmlnIl0...",
"expiryInDays": 30,
"timestamp": "2026-08-09T10:15:30Z",
"expiryTimestamp": "2026-09-08T10:15:30Z",
"type": "igrantio",
"sandboxOrgId": "6889e1a4c5b2f30001a3d710",
"createdBy": {
"id": "6889e1a4c5b2f30001a3d6e0",
"email": "[email protected]",
"at": "2026-08-09T10:15:30Z"
}
}
}
{
"apiKey": {
"id": "6889e1a4c5b2f30001a3d720",
"name": "Production issuance key",
"scopes": [
"config"
],
"apiKey": "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJTY29wZXMiOlsiY29uZmlnIl0...",
"expiryInDays": 90,
"timestamp": "2026-08-09T11:02:11Z",
"expiryTimestamp": "2026-11-07T11:02:11Z",
"type": "igrantio",
"createdBy": {
"id": "6889e1a4c5b2f30001a3d6e0",
"email": "[email protected]",
"at": "2026-08-09T10:15:30Z"
}
}
}
The request is invalid. The service returns this status when apiKey or scopes is missing, or when scopes holds a value other than config, audit, service or onboard.
Response Headers
- application/json
- Schema
- Example (from schema)
Schema
{
"errorCode": 400,
"errorDescription": "Bad input parameter"
}
Unauthorized
Response Headers
- application/json
- Schema
- Example (from schema)
Schema
{
"errorCode": 400,
"errorDescription": "Bad input parameter"
}
The caller has no permission for this operation. Only an organisation administrator can manage API keys.
Response Headers
- application/json
- Schema
- Example (from schema)
Schema
{
"errorCode": 400,
"errorDescription": "Bad input parameter"
}
Internal server error. The service also returns this status when the API key of apiKeyId does not exist, or when it is deleted.
Response Headers
- application/json
- Schema
- Example (from schema)
Schema
{
"errorCode": 400,
"errorDescription": "Bad input parameter"
}