name, acl permission map, and config constraints. All fields are optional; only the fields included in the request body are changed, everything else on the key is left untouched. The key's environment, public_key, and secret material can never be changed through this endpoint — use the rotate endpoint to replace the secret key. Renaming a key still enforces the same uniqueness rule as creation: an identity cannot have two active keys sharing a name. Protected sandbox master keys can never be edited through this endpoint and are rejected outright, regardless of ownership.curl --location --request PATCH '/api-keys/01J5X8PMKW3RNVBQE2D7F9GHAT' \
--header 'Authorization: Bearer <token>' \
--header 'Content-Type: application/json' \
--data '{
"name": "Renamed Production Key"
}'{
"message": "API key updated successfully",
"status": "success",
"data": {
"id": "01J5X8PMKW3RNVBQE2D7F9GHAT",
"name": "Renamed Production Key",
"environment": "live",
"identity_id": "01J5X8PMKW3RNVBQE2D7F9GHBT",
"public_key": "pk_live_8f2a1c7d3e9b4f5a",
"expires_at": null,
"status": "active",
"acl": {
"can_view_api_key": true,
"can_list_api_keys": true
},
"config": {
"allowed_ip": {
"203.0.113.10": true
}
},
"created": 1754478720000,
"updated": 1754651520000
}
}