Update a Project Key’s name, description, roles, tool scoping, or Kafka ACLs.
Supports additive capability transitions:
kafka_config on an API-only PK to add Kafka access. Response will include
new_kafka_credentials with the plaintext Kafka password (shown once).role_ids or permission_ids on a Kafka-only PK to add API credentials.
Response will include new_api_credentials with the plaintext client_secret (shown once).Returns 400 if the key is in creating/deleting/delete_failed state. role_ids and permission_ids are mutually exclusive.
Bearer authentication header of the form Bearer <token>, where <token> is your auth token.
Request body for updating a Project Key.
Updated name
1 - 100Updated description (HTML sanitized)
Change the Frontegg roles for this PK, or assign roles when adding API access to a Kafka-only PK. Note: changing roles on an existing API credential only takes effect when the current JWT expires. See token_ttl_seconds in the detail response for the validity window.
1Assign fine-grained permissions when ADDING API access to a Kafka-only PK. Changing permissions on an existing API credential is NOT supported — to change permissions on an existing PK, either switch to role_ids or delete and recreate the PK. This field is only accepted when the PK has no api_client_id yet.
1Add Kafka access to a PK that currently has none. Only valid when the PK has no Kafka user yet.
Rotate the Kafka SASL password for an existing Kafka user. PK must have kafka_username.
12 - 128full, read-only, agent-operator, infra-admin Successful Response
Response for PATCH /project-keys/{id}.
Extends the summary with plaintext secrets when an additive capability transition
occurred. For regular updates (no capability change), both new_api_credentials and
new_kafka_credentials are None.
full, read-only, agent-operator, infra-admin Present only when API credentials were ADDED to a Kafka-only PK. Contains the plaintext client_secret — shown only once.
Present only when Kafka access was ADDED to an API-only PK. Contains the plaintext Kafka password — shown only once.
Current Frontegg JWT TTL in seconds (dynamic). Used by the frontend to compute how long role changes take to propagate.
Non-blocking informational messages the frontend should surface to the user after the update (e.g. 'role changes take effect within X hours'). Empty list when there is nothing to warn about.