Update Member API Key

PATCH/enterprise/v1/sub-accounts/{subAccountId}/api-keys/{hash}

status is required even for budget-only updates: ACTIVE or DISABLED. Optional name renames the key. allowedIps omitted/null keeps the list; [] clears it. Set spendLimitPresent=true to apply spendLimit, including null to remove the limit. Set limitResetPresent=true to apply limitReset, including null for lifetime. Without these flags, budget fields are not applied. Limits are USD and do not grant additional account funds.

Authentication

MANAGEMENT / PROVISIONING key with tenant:keys:write.

Authorization: Bearer <CONTROL_KEY>

Any subAccountId must belong to the authenticated enterprise. hash is a metadata identifier, never a raw key.

Approval and retries

Approval-enabled enterprises require Idempotency-Key and may receive HTTP 409 / APPROVAL_REQUIRED with data.operation.executed=false. Nothing has executed at that point. Other enterprises execute directly; do not assume arbitrary POST requests support idempotent retries.

Approval and retry guide

Path parameters

subAccountIdstringrequired

10-digit public member ID / 10 位成员编号

hashstringrequired

Public key hash / 公开 Key hash

Request body

statusstringrequired

ACTIVE | DISABLED

namestring

Key name / Key 名称

allowedIpsstring[] | null

null keeps current; [] clears / null 保持；[] 清空

spendLimitnumber | null

USD > 0; null clears with presence flag / 美元正数，配合标志可传 null 清除

spendLimitPresentboolean

true applies spendLimit / true 才应用 spendLimit

limitResetstring | null

daily | weekly | monthly | null

limitResetPresentboolean

true applies limitReset / true 才应用 limitReset

Fields use camelCase. Required and optional fields are described above.

JSON

1{
2  "status": "ACTIVE",
3  "spendLimit": 100,
4  "spendLimitPresent": true,
5  "limitReset": "monthly",
6  "limitResetPresent": true
7}

Response

HTTP 200; code: 200. Values below are illustrative; fields use camelCase.

codeinteger

200

dataobject | null

data.hashstring

data.namestring

data.keyDisplaystring

data.workspaceCodestring

data.statusstring

data.allowedIpsarray

data.spendLimitnumber

data.limitResetstring

data.expiresAtstring | null

data.createdAtstring

Errors

Check both HTTP status and code; on failure inspect serviceCode, msg and traceId. Invalid credentials receive no data; missing scopes return API_KEY_SCOPE_DENIED. Cross-tenant resources are inaccessible. Acceptance or pending approval does not mean business completion.

Request

Shell

1curl -X PATCH "https://api.token360.ai/enterprise/v1/sub-accounts/{subAccountId}/api-keys/{hash}" \
2  -H "Authorization: Bearer $CONTROL_KEY" \
3  -H "Idempotency-Key: <UNIQUE_INTENT_ID>" \
4  -H "Content-Type: application/json" \
5  --data '{"status": "ACTIVE", "spendLimit": 100, "spendLimitPresent": true, "limitReset": "monthly", "limitResetPresent": true}'

Response

JSON

1{
2  "code": 200,
3  "msg": "success",
4  "data": {
5    "hash": "<KEY_HASH>",
6    "name": "service-key",
7    "keyDisplay": "sk-…",
8    "workspaceCode": "DEFAULT",
9    "status": "ACTIVE",
10    "allowedIps": [],
11    "spendLimit": 100,
12    "limitReset": "monthly",
13    "expiresAt": null,
14    "createdAt": "2026-11-03T00:00:00Z"
15  }
16}

Was this page helpful?