`PATCH /auth/api-keys/{id}`

Replace a key's IP allow-list. This is a full replacement, not a merge: send the complete desired set of entries every time. An empty array clears all restrictions, making the key usable from anywhere again.

Everything else about a key (label, expiry, environment) is fixed at mint time. The allow-list is the only mutable field.

Permission model matches revoke: org owner and admin can edit any key in the org. Everyone else can only edit keys they minted themselves. Pre-check the can_revoke flag on each row to avoid the round-trip.

Request body

{
  "ip_allowlist": [
    "203.0.113.4",
    "10.0.0.0/8"
  ]
}

Field	Type	Required	Notes
`ip_allowlist`	string[]	yes	Full replacement set of CIDR ranges / bare IPs. Pass `[]` to clear. Up to 50 entries.

Response 200: the updated ApiKey (no secret). Bare addresses are echoed in normalized CIDR form.

{
  "id": "k_2f10…",
  "org_id": "0a2a…",
  "prefix": "seismic_prod_abc12…",
  "label": "ci-pipeline",
  "created_by": "9d11…",
  "created_at": "2026-04-29T15:00:00Z",
  "expires_at": "2026-05-29T15:00:00Z",
  "last_used_at": "2026-04-30T09:12:00Z",
  "revoked_at": null,
  "ip_allowlist": [
    "203.0.113.4/32",
    "10.0.0.0/8"
  ],
  "access": "full",
  "can_revoke": true
}

Errors:

400 InvalidRequest: an entry isn't a valid IP or CIDR, or the list exceeds 50 entries.
404 ApiKeyNotFound: unknown key id (or belongs to a different org).
403 ApiKeyRevokeForbidden: caller is an org member but is neither owner/admin nor the key's creator.

Example

curl -X PATCH "$SEISMIC_ORCHESTRATION_URL/v0/auth/api-keys/k_2f10…" \
  -H "Api-Key: $SEISMIC_ORCHESTRATION_API_KEY" \
  -H "content-type: application/json" \
  -d '{ "ip_allowlist": ["203.0.113.4", "10.0.0.0/8"] }'

To clear all restrictions:

curl -X PATCH "$SEISMIC_ORCHESTRATION_URL/v0/auth/api-keys/k_2f10…" \
  -H "Api-Key: $SEISMIC_ORCHESTRATION_API_KEY" \
  -H "content-type: application/json" \
  -d '{ "ip_allowlist": [] }'