Skip to main content
PUT
Change an API key's expiry

Authorizations

Authorization
string
header
required

A Barndoor API key, sent as Authorization: Bearer <key>. Keys are prefixed bdai_ and are opaque — do not attempt to decode one. Interchangeable with an OAuth 2.0 access token.

Path Parameters

id
string<uuid>
required

Identifier, a UUID

Body

application/json

Body of PUT /admin/api-keys/{id}/expiry (BCP-5209).

expires_at
string<date-time> | null

The new expiry. null removes it, so the key never expires. Must be in the future. Required: a missing field is a 400 rather than a silent "never expires".

Response

The updated record

created_at
string<date-time>
required
created_by_user_id
string<uuid>
required
id
string<uuid>
required
key_prefix
string
required
kind
enum<string>
required

Category of credential (BCP-3510). Set at insert, never updated.

Available options:
user,
machine,
agent_session
name
string
required
org_id
string<uuid>
required
scopes
string[]
required
disabled_at
string<date-time> | null

When this key was temporarily disabled. Unlike revoked_at this is reversible: the auth path rejects the key while set, but re-enabling (clearing it) restores access without re-issuing the secret.

expires_at
string<date-time> | null
group_name
string | null

Optional explicit IdP group binding for this key. NULL means no explicit group; the key still inherits the assigned user's IdP groups at request time for governance scope matching.

last_used_at
string<date-time> | null

When this key last authenticated a request. None means it has never been used. Updated best-effort and throttled on the auth path (see touch_last_used), so it is accurate to within last_used_min_interval.

previous_key_expires_at
string<date-time> | null

End of the grace period granted by the last rotation: until then the previous secret still authenticates as this key. None, or a time in the past, means only the current secret works.

revoked_at
string<date-time> | null
rotated_at
string<date-time> | null

When the secret was last replaced in place (BCP-5195). None means the key still carries the secret it was created with.

user_id
string<uuid> | null