# Update API key

> PATCH /api-keys/:id — rename a key or change its permission and domain restriction.

`PATCH /api-keys/:id`

Updates an API key in place — no need to mint a new token to change what an existing key may do. Omitted fields stay unchanged. The secret token itself is immutable and never re-shown: to rotate credentials, create a new key and revoke this one. An API-key caller must hold `full_access` to update keys.

**Path parameters**

| Name | Type | Required | Description |
| --- | --- | --- | --- |
| `id` | string | Yes | The API key ID. |

**Body parameters**

| Name | Type | Required | Description |
| --- | --- | --- | --- |
| `name` | string | No | A new label for the key. |
| `permission` | full_access | sending_access | No | The new access level. Setting `full_access` also clears any domain restriction — full-access keys always work across all your domains. |
| `domain_ids` | string[] | null | No | Replace the key’s domain restriction. Only valid with `sending_access`. Send `null` (or an empty array) to allow all domains. Omit the field to leave the current restriction unchanged. |
| `domain_id` | string | No | Legacy single-domain form of `domain_ids`. Provide one or the other, not both. |

**Node.js**

```js
const res = await fetch('https://www.mailblastr.com/api/api-keys/dacf4072-4119-4d88-932f-6202748ac7c8', {
  method: 'PATCH',
  headers: {
    'Authorization': 'Bearer mb_xxxxxxxxx',
    'Content-Type': 'application/json',
  },
  body: JSON.stringify({
  "permission": "sending_access",
  "domain_ids": ["b8f9c2aa-4c11-4f24-9d55-1f7a2b3c4d5e"]
}),
});
const data = await res.json();
console.log(data);
```

**Ruby**

```ruby
require 'net/http'
require 'uri'

uri = URI('https://www.mailblastr.com/api/api-keys/dacf4072-4119-4d88-932f-6202748ac7c8')
http = Net::HTTP.new(uri.host, uri.port)
http.use_ssl = true
req = Net::HTTP::Patch.new(uri)
req['Authorization'] = 'Bearer mb_xxxxxxxxx'
req['Content-Type'] = 'application/json'
req.body = <<~JSON
{
  "permission": "sending_access",
  "domain_ids": ["b8f9c2aa-4c11-4f24-9d55-1f7a2b3c4d5e"]
}
JSON
res = http.request(req)
puts res.body
```

**PHP**

```php
<?php
$ch = curl_init('https://www.mailblastr.com/api/api-keys/dacf4072-4119-4d88-932f-6202748ac7c8');
curl_setopt_array($ch, [
    CURLOPT_CUSTOMREQUEST => 'PATCH',
    CURLOPT_RETURNTRANSFER => true,
    CURLOPT_HTTPHEADER => [
        'Authorization: Bearer mb_xxxxxxxxx',
        'Content-Type: application/json',
    ],
    CURLOPT_POSTFIELDS => <<<'JSON'
{
  "permission": "sending_access",
  "domain_ids": ["b8f9c2aa-4c11-4f24-9d55-1f7a2b3c4d5e"]
}
JSON,
]);
$response = curl_exec($ch);
curl_close($ch);
echo $response;
```

**Python**

```python
import requests

res = requests.patch(
    "https://www.mailblastr.com/api/api-keys/dacf4072-4119-4d88-932f-6202748ac7c8",
    headers={"Authorization": "Bearer mb_xxxxxxxxx", "Content-Type": "application/json"},
    json={
  "permission": "sending_access",
  "domain_ids": ["b8f9c2aa-4c11-4f24-9d55-1f7a2b3c4d5e"]
},
)
print(res.json())
```

**Go**

```go
package main

import (
    "fmt"
    "io"
    "net/http"
    "strings"
)

func main() {
    req, _ := http.NewRequest("PATCH", "https://www.mailblastr.com/api/api-keys/dacf4072-4119-4d88-932f-6202748ac7c8", strings.NewReader(`{
  "permission": "sending_access",
  "domain_ids": ["b8f9c2aa-4c11-4f24-9d55-1f7a2b3c4d5e"]
}`))
    req.Header.Set("Authorization", "Bearer mb_xxxxxxxxx")
    req.Header.Set("Content-Type", "application/json")
    res, _ := http.DefaultClient.Do(req)
    defer res.Body.Close()
    out, _ := io.ReadAll(res.Body)
    fmt.Println(string(out))
}
```

**Rust**

```rust
use reqwest::Client;

#[tokio::main]
async fn main() -> Result<(), Box<dyn std::error::Error>> {
    let res = Client::new()
        .patch("https://www.mailblastr.com/api/api-keys/dacf4072-4119-4d88-932f-6202748ac7c8")
        .header("Authorization", "Bearer mb_xxxxxxxxx")
        .header("Content-Type", "application/json")
        .body(r#"{
  "permission": "sending_access",
  "domain_ids": ["b8f9c2aa-4c11-4f24-9d55-1f7a2b3c4d5e"]
}"#)
        .send()
        .await?;
    println!("{}", res.text().await?);
    Ok(())
}
```

**Java**

```java
import java.net.URI;
import java.net.http.HttpClient;
import java.net.http.HttpRequest;
import java.net.http.HttpResponse;

var client = HttpClient.newHttpClient();
var request = HttpRequest.newBuilder()
    .uri(URI.create("https://www.mailblastr.com/api/api-keys/dacf4072-4119-4d88-932f-6202748ac7c8"))
    .header("Authorization", "Bearer mb_xxxxxxxxx")
    .header("Content-Type", "application/json")
    .method("PATCH", HttpRequest.BodyPublishers.ofString("""
{
  "permission": "sending_access",
  "domain_ids": ["b8f9c2aa-4c11-4f24-9d55-1f7a2b3c4d5e"]
}
"""))
    .build();
var response = client.send(request, HttpResponse.BodyHandlers.ofString());
System.out.println(response.body());
```

**.NET**

```csharp
using System.Net.Http;
using System.Text;

var client = new HttpClient();
var request = new HttpRequestMessage(HttpMethod.Patch, "https://www.mailblastr.com/api/api-keys/dacf4072-4119-4d88-932f-6202748ac7c8");
request.Headers.Add("Authorization", "Bearer mb_xxxxxxxxx");
request.Content = new StringContent(@"{
  ""permission"": ""sending_access"",
  ""domain_ids"": [""b8f9c2aa-4c11-4f24-9d55-1f7a2b3c4d5e""]
}", Encoding.UTF8, "application/json");
var response = await client.SendAsync(request);
Console.WriteLine(await response.Content.ReadAsStringAsync());
```

**cURL**

```bash
curl -X PATCH 'https://www.mailblastr.com/api/api-keys/dacf4072-4119-4d88-932f-6202748ac7c8' \
  -H 'Authorization: Bearer mb_xxxxxxxxx' \
  -H 'Content-Type: application/json' \
  -d '{
  "permission": "sending_access",
  "domain_ids": ["b8f9c2aa-4c11-4f24-9d55-1f7a2b3c4d5e"]
}'
```

### Response

```json
{
  "id": "dacf4072-4119-4d88-932f-6202748ac7c8",
  "object": "api_key",
  "name": "Production server",
  "token": "mb_AbC12",
  "permission": "sending_access",
  "domain_id": "b8f9c2aa-4c11-4f24-9d55-1f7a2b3c4d5e",
  "domain_ids": ["b8f9c2aa-4c11-4f24-9d55-1f7a2b3c4d5e"],
  "created_at": "2026-06-23T10:00:00.000Z",
  "last_used_at": "2026-06-25T17:09:51.813Z"
}
```

> **Note:** Errors: `not_found` if the key does not exist, is revoked, or is not yours; `validation_error` if no updatable field is provided, `name` is empty, `permission` is invalid, both `domain_id` and `domain_ids` are provided, a domain restriction is combined with `full_access`, or `domain_ids` references a domain that is not yours; `restricted_api_key` if the calling key lacks full access.