# Rename a Key, Edit Origins, Budget or Scope

`PATCH https://api.astroway.info/v1/keys/{id}`

Rename a key, rewrite the origin list of a publishable key, set a per-key credit budget, limit the key to a subset of endpoints, or any combination. The class is fixed at creation: a pk_ key cannot become server-only, and a secret key cannot be given a list, so either request is refused with 400 rather than quietly rewritten. A new list takes effect at once and the key string does not change. credits_cap_cycle caps what this one key may spend per billing cycle, which credits alone do not, since they pool across the account; null clears it and a call over the cap answers 429 KEY_BUDGET_EXHAUSTED without falling through to overage. allowed_endpoints takes paths under /v1, exact ("chart") or a namespace ("embed/*"); null removes the limit and a call outside the list answers 403 ENDPOINT_NOT_IN_SCOPE.

Group: System. Auth: `X-Api-Key` header. Operation ID: `keys_{id}_patch`.

## Request body

| Field | Type | Required | Description |
|---|---|---|---|
| `name` | string | no |  |
| `origin_restriction` | object | no |  |
| `origin_restriction.type` | "server-only" \| "public" | no |  |
| `origin_restriction.allowed_origins` | string[] | no |  |
| `credits_cap_cycle` | integer \| object | no |  |
| `allowed_endpoints` | string[] \| object | no |  |

```json
{
  "name": "site-widget",
  "credits_cap_cycle": 5000,
  "allowed_endpoints": [
    "embed/*"
  ],
  "origin_restriction": {
    "type": "public",
    "allowed_origins": [
      "example.com",
      "*.example.com"
    ]
  }
}
```

## Responses

| Status | Meaning |
|---|---|
| 200 | Successful calculation |
| 400 | Validation error |
| 401 | Missing or invalid API key |

### Success fields, under `data`

| Field | Type | Required | Description |
|---|---|---|---|
| `id` | number | no |  |
| `api_key_masked` | string | no |  |
| `name` | string | no |  |
| `plan` | string | no |  |
| `rate_limit` | number | no |  |
| `credits_limit` | number | no |  |
| `credits_used` | number | no |  |
| `created_at` | string | no |  |
| `last_used_at` | object | no |  |
| `is_active` | boolean | no |  |
| `origin_restriction` | object | no |  |
| `origin_restriction.type` | string | no |  |
| `origin_restriction.allowed_origins` | string[] | no |  |
| `credits_cap_cycle` | number | no |  |
| `allowed_endpoints` | string[] | no |  |

## Example

```bash
curl -X PATCH https://api.astroway.info/v1/keys/{id} \
  -H "X-Api-Key: aw_live_..." \
  -H "Content-Type: application/json" \
  -d '{ "name": "site-widget", "credits_cap_cycle": 5000, "allowed_endpoints": [ "embed/*" ], "origin_restriction": { "type": "public", "allowed_origins": [ "example.com", "*.example.com" ] } }'
```

---

Rendered from https://api.astroway.info/v1/openapi.json. HTML page: https://api.astroway.info/docs/api/operations/keys_id_patch/