Skip to main content
PATCH
Update Project Key

Authorizations

Authorization
string
header
required

Bearer authentication header of the form Bearer <token>, where <token> is your auth token.

Path Parameters

project_key_id
string
required

Body

application/json

Request body for updating a Project Key.

name
string | null

Updated name

Required string length: 1 - 100
description
string | null

Updated description (HTML sanitized)

role_ids
string[] | null

Change the Frontegg roles for this PK, or assign roles when adding API access to a Kafka-only PK. Note: changing roles on an existing API credential only takes effect when the current JWT expires. See token_ttl_seconds in the detail response for the validity window.

Minimum array length: 1
permission_ids
string[] | null

Assign fine-grained permissions when ADDING API access to a Kafka-only PK. Changing permissions on an existing API credential is NOT supported — to change permissions on an existing PK, either switch to role_ids or delete and recreate the PK. This field is only accepted when the PK has no api_client_id yet.

Minimum array length: 1
kafka_acls
KafkaAclModel · object[] | null
whitelist_ips
string | null
kafka_config
ProjectKeyKafkaConfig · object | null

Add Kafka access to a PK that currently has none. Only valid when the PK has no Kafka user yet.

kafka_password
string | null

Rotate the Kafka SASL password for an existing Kafka user. PK must have kafka_username.

Required string length: 12 - 128
tool_profile
enum<string> | null
Available options:
full,
read-only,
agent-operator,
infra-admin
allowed_tools
string[] | null
blocked_tools
string[] | null

Response

Successful Response

Response for PATCH /project-keys/{id}.

Extends the summary with plaintext secrets when an additive capability transition occurred. For regular updates (no capability change), both new_api_credentials and new_kafka_credentials are None.

id
string
required
name
string
required
service_id
string
required
status
string
required
description
string | null
created_at
string<date-time> | null
created_by_user
User · object | null
api_client_id
string | null
api_client_id_masked_secret
string | null
kafka_username
string | null
roles
Role · object[]
last_used_at
string<date-time> | null
tool_profile
enum<string> | null
Available options:
full,
read-only,
agent-operator,
infra-admin
allowed_tools
string[] | null
blocked_tools
string[] | null
new_api_credentials
ProjectKeyApiCredentials · object | null

Present only when API credentials were ADDED to a Kafka-only PK. Contains the plaintext client_secret — shown only once.

new_kafka_credentials
ProjectKeyKafkaCredentials · object | null

Present only when Kafka access was ADDED to an API-only PK. Contains the plaintext Kafka password — shown only once.

token_ttl_seconds
integer

Current Frontegg JWT TTL in seconds (dynamic). Used by the frontend to compute how long role changes take to propagate.

warnings
string[]

Non-blocking informational messages the frontend should surface to the user after the update (e.g. 'role changes take effect within X hours'). Empty list when there is nothing to warn about.