> ## Documentation Index
> Fetch the complete documentation index at: https://docs.terminaluse.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Update API Key Scopes

> Update scopes for an API key. Only org admins can update key scopes.

Each scope grants a role on a specific resource:

```json theme={"dark"}
{
  "resource_type": "agent",
  "resource_id": "agt_xxx",
  "role": "editor"
}
```

### Valid Roles by Resource Type

| Resource Type | Valid Roles                                           |
| ------------- | ----------------------------------------------------- |
| `org`         | `admin`, `member`                                     |
| `namespace`   | `admin`                                               |
| `project`     | `discoverer`, `viewer`, `editor`, `owner`             |
| `agent`       | `discoverer`, `viewer`, `editor`, `owner`, `executor` |

<Note>
  The `executor` role is legacy and is normalized to `viewer` internally, but still grants `run` permission.
</Note>


## OpenAPI

````yaml openapi.json PATCH /api_keys/{api_key_id}
openapi: 3.1.0
info:
  title: Sb0 API
  version: 0.1.0
servers: []
security: []
paths:
  /api_keys/{api_key_id}:
    patch:
      tags:
        - API Keys
      summary: Update API Key Scopes
      description: Update scopes for an API key. Only org admins can update key scopes.
      operationId: api_keys_update_scopes
      parameters:
        - in: path
          name: api_key_id
          required: true
          schema:
            title: Api Key Id
            type: string
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/ApiKeyScopesUpdateRequest'
        required: true
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ApiKeyResponse'
          description: Successful Response
        '422':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/HTTPValidationError'
          description: Validation Error
components:
  schemas:
    ApiKeyScopesUpdateRequest:
      description: Request model for updating API key scopes.
      properties:
        scopes:
          description: Updated list of resource scopes.
          items:
            $ref: '#/components/schemas/ApiKeyScope'
          minItems: 1
          title: Scopes
          type: array
      required:
        - scopes
      title: ApiKeyScopesUpdateRequest
      type: object
    ApiKeyResponse:
      description: Response model for API key (excludes sensitive data).
      properties:
        created_at:
          anyOf:
            - format: date-time
              type: string
            - type: 'null'
          description: When the key was created.
          title: Created At
        created_by:
          description: member_id of the creator.
          title: Created By
          type: string
        description:
          anyOf:
            - type: string
            - type: 'null'
          description: Optional description.
          title: Description
        id:
          description: The unique identifier of the API key.
          title: Id
          type: string
        key_prefix:
          description: Display prefix (e.g., 'sk_tu_abc...').
          title: Key Prefix
          type: string
        last_used_at:
          anyOf:
            - format: date-time
              type: string
            - type: 'null'
          description: When the key was last used.
          title: Last Used At
        name:
          description: Human-readable name for the API key.
          title: Name
          type: string
        org_id:
          description: WorkOS organization ID.
          title: Org Id
          type: string
        revoked_at:
          anyOf:
            - format: date-time
              type: string
            - type: 'null'
          description: When the key was revoked (soft delete).
          title: Revoked At
        scopes:
          description: List of resource scopes for this API key.
          items:
            $ref: '#/components/schemas/ApiKeyScope'
          title: Scopes
          type: array
        sharing_group_ids:
          description: >-
            Groups that receive default admin grants on resources created by
            this key.
          items:
            type: string
          title: Sharing Group Ids
          type: array
      required:
        - id
        - org_id
        - key_prefix
        - name
        - created_by
      title: ApiKeyResponse
      type: object
    HTTPValidationError:
      properties:
        detail:
          items:
            $ref: '#/components/schemas/ValidationError'
          title: Detail
          type: array
      title: HTTPValidationError
      type: object
    ApiKeyScope:
      description: Scope definition for an API key - defines resource and role access.
      properties:
        resource_id:
          description: ID of the resource.
          title: Resource Id
          type: string
        resource_type:
          description: Type of resource (namespace, project, agent).
          title: Resource Type
          type: string
        role:
          $ref: '#/components/schemas/ApiKeyScopeRole'
          description: Role for this resource.
      required:
        - resource_type
        - resource_id
        - role
      title: ApiKeyScope
      type: object
    ValidationError:
      properties:
        loc:
          items:
            anyOf:
              - type: string
              - type: integer
          title: Location
          type: array
        msg:
          title: Message
          type: string
        type:
          title: Error Type
          type: string
      required:
        - loc
        - msg
        - type
      title: ValidationError
      type: object
    ApiKeyScopeRole:
      description: Role that can be assigned to an API key for a scoped resource.
      enum:
        - discoverer
        - viewer
        - editor
        - admin
        - owner
        - member
        - executor
      title: ApiKeyScopeRole
      type: string

````