Update API Key Configurations
Replaces the whole set. Sending an empty list detaches the key from everything, which stops it reaching data without revoking it.
Requires apikey:manage even on your own key, because widening what a
credential reaches is a management action. Every id is verified before
anything is written, so a request naming one bad id does not
half-apply. The change takes effect immediately across the cluster.
Authorizations
A machine credential, qk_ followed by its secret. The first twelve
characters are an indexed prefix; the rest is compared in constant time
against a stored SHA-256 hash. A key reaches only the configurations it is
linked to.
It may also be sent as Authorization: Bearer qk_..., which is
recognised by the prefix.
Path Parameters
Body
The complete new set. An empty array detaches everything.
Response
The key, with its new configuration set.
The owning user. Classification clearance for this key resolves through this user and their role.
The indexed first twelve characters.
"qk_TEcj6-ebd"
The configurations this key may reach. An empty list means none: the grant is explicit, so a newly minted key cannot touch data until somebody says which data it is for.