OpenAI API (unofficial showcase)
POST/organization/projects/{project_id}/api_keys/{api_key_id}

Update project API key

Updates the scopes and/or expiration of an existing API key in the project, including a service-account-owned key. Requires permission to write project API keys.

Provide at least one of scopes or expires_in_seconds. Omitted fields stay unchanged; neither field accepts null. Both changes are saved together.

scopes replaces the key's scope restrictions using the same scope identifiers as the dashboard. An empty array means All permissions, subject to the owner's effective access; it does not mean no access. Use ["api.all.read"] for read-only access or specific scopes such as ["api.files.read"] for restricted access. This does not change user or service-account roles or grant admin permissions. Scope changes follow the same authentication-cache propagation as dashboard edits.

Provide expires_in_seconds to set the expiration relative to this request. The value must satisfy the organization's and project's expiry policies. Expired keys cannot be updated. Retrying resets the expiration relative to the new request. The response contains only the redacted key, not its secret.

  • IdempotentThe SDK sends Idempotency-Key, so a retried request is only applied once.

2 parameters · 2 body fields
project_idstringrequired
The ID of the project.
api_key_idstringrequired
The ID of the API key.
expires_in_secondsintegeroptional
Number of seconds from this request until the API key expires. Must comply with the organization and project expiry policies. Expired keys cannot be updated. Retrying resets the expiry relative to the new request. Omit to keep the current expiration.
scopesarray<string>optional
Replace the API key scope restrictions. Omit to leave scopes unchanged. An empty array removes key restrictions (All permissions), subject to the owner's effective permissions. Use ["api.all.read"] for read-only access. Scopes do not change the owner's roles or grant administrative permissions.

5 status codes
200Project API key updated successfully.
objectstringrequired
The object type, which is always `organization.project.api_key`
Allowed:organization.project.api_key
redacted_valuestringrequired
The redacted value of the API key
namestringrequired
The name of the API key
created_atintegerrequired
The Unix timestamp (in seconds) of when the API key was created
expires_atintegeroptional
The Unix timestamp (in seconds) when the API key expires, or null if it does not expire.
last_used_atintegerrequired
The Unix timestamp (in seconds) of when the API key was last used.
idstringrequired
The identifier, which can be referenced in API endpoints
owner_project_accessstringrequired
Whether the API key's owner currently has effective access to the project.
Allowed:activeinactive
ownerobjectrequired
400The project is archived, the key is expired, or the requested scopes or expiration are invalid.
errorobjectrequired
403The caller does not have permission to update this API key.
errorobjectrequired
Details about the permission error.
404The project or API key was not found.
errorobjectrequired
429Too many management requests. Reduce the request rate and try again later.
errorobjectrequired

Error handling

A 400 is returned: The project is archived, the key is expired, or the requested scopes or expiration are invalid. A 403 is returned: The caller does not have permission to update this API key. A 404 is returned: The project or API key was not found. A 429 is returned: Too many management requests. Reduce the request rate and try again later.