curl --request PUT \
--url https://{host}/api/llm-gateway/admin/api-keys/{id}/expiry \
--header 'Authorization: Bearer <token>' \
--header 'Content-Type: application/json' \
--data '
{
"expires_at": "2023-11-07T05:31:56Z"
}
'import requests
url = "https://{host}/api/llm-gateway/admin/api-keys/{id}/expiry"
payload = { "expires_at": "2023-11-07T05:31:56Z" }
headers = {
"Authorization": "Bearer <token>",
"Content-Type": "application/json"
}
response = requests.put(url, json=payload, headers=headers)
print(response.text)const options = {
method: 'PUT',
headers: {Authorization: 'Bearer <token>', 'Content-Type': 'application/json'},
body: JSON.stringify({expires_at: '2023-11-07T05:31:56Z'})
};
fetch('https://{host}/api/llm-gateway/admin/api-keys/{id}/expiry', options)
.then(res => res.json())
.then(res => console.log(res))
.catch(err => console.error(err));<?php
$curl = curl_init();
curl_setopt_array($curl, [
CURLOPT_URL => "https://{host}/api/llm-gateway/admin/api-keys/{id}/expiry",
CURLOPT_RETURNTRANSFER => true,
CURLOPT_ENCODING => "",
CURLOPT_MAXREDIRS => 10,
CURLOPT_TIMEOUT => 30,
CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
CURLOPT_CUSTOMREQUEST => "PUT",
CURLOPT_POSTFIELDS => json_encode([
'expires_at' => '2023-11-07T05:31:56Z'
]),
CURLOPT_HTTPHEADER => [
"Authorization: Bearer <token>",
"Content-Type: application/json"
],
]);
$response = curl_exec($curl);
$err = curl_error($curl);
curl_close($curl);
if ($err) {
echo "cURL Error #:" . $err;
} else {
echo $response;
}package main
import (
"fmt"
"strings"
"net/http"
"io"
)
func main() {
url := "https://{host}/api/llm-gateway/admin/api-keys/{id}/expiry"
payload := strings.NewReader("{\n \"expires_at\": \"2023-11-07T05:31:56Z\"\n}")
req, _ := http.NewRequest("PUT", url, payload)
req.Header.Add("Authorization", "Bearer <token>")
req.Header.Add("Content-Type", "application/json")
res, _ := http.DefaultClient.Do(req)
defer res.Body.Close()
body, _ := io.ReadAll(res.Body)
fmt.Println(string(body))
}HttpResponse<String> response = Unirest.put("https://{host}/api/llm-gateway/admin/api-keys/{id}/expiry")
.header("Authorization", "Bearer <token>")
.header("Content-Type", "application/json")
.body("{\n \"expires_at\": \"2023-11-07T05:31:56Z\"\n}")
.asString();require 'uri'
require 'net/http'
url = URI("https://{host}/api/llm-gateway/admin/api-keys/{id}/expiry")
http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true
request = Net::HTTP::Put.new(url)
request["Authorization"] = 'Bearer <token>'
request["Content-Type"] = 'application/json'
request.body = "{\n \"expires_at\": \"2023-11-07T05:31:56Z\"\n}"
response = http.request(request)
puts response.read_body{
"created_at": "2023-11-07T05:31:56Z",
"created_by_user_id": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
"id": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
"key_prefix": "<string>",
"kind": "user",
"name": "<string>",
"org_id": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
"scopes": [
"<string>"
],
"disabled_at": "2023-11-07T05:31:56Z",
"expires_at": "2023-11-07T05:31:56Z",
"group_name": "<string>",
"last_used_at": "2023-11-07T05:31:56Z",
"previous_key_expires_at": "2023-11-07T05:31:56Z",
"revoked_at": "2023-11-07T05:31:56Z",
"rotated_at": "2023-11-07T05:31:56Z",
"user_id": "3c90c3cc-0d44-4b50-8888-8dd25736052a"
}Change an API key's expiry
Extend, shorten or remove a key’s expiry without issuing a new secret, so clients keep working unchanged. Also reactivates an expired key. A shortened expiry takes effect immediately. Admin only, and not limited by the API key lifetime policy. To replace the secret as well, rotate the key instead.
curl --request PUT \
--url https://{host}/api/llm-gateway/admin/api-keys/{id}/expiry \
--header 'Authorization: Bearer <token>' \
--header 'Content-Type: application/json' \
--data '
{
"expires_at": "2023-11-07T05:31:56Z"
}
'import requests
url = "https://{host}/api/llm-gateway/admin/api-keys/{id}/expiry"
payload = { "expires_at": "2023-11-07T05:31:56Z" }
headers = {
"Authorization": "Bearer <token>",
"Content-Type": "application/json"
}
response = requests.put(url, json=payload, headers=headers)
print(response.text)const options = {
method: 'PUT',
headers: {Authorization: 'Bearer <token>', 'Content-Type': 'application/json'},
body: JSON.stringify({expires_at: '2023-11-07T05:31:56Z'})
};
fetch('https://{host}/api/llm-gateway/admin/api-keys/{id}/expiry', options)
.then(res => res.json())
.then(res => console.log(res))
.catch(err => console.error(err));<?php
$curl = curl_init();
curl_setopt_array($curl, [
CURLOPT_URL => "https://{host}/api/llm-gateway/admin/api-keys/{id}/expiry",
CURLOPT_RETURNTRANSFER => true,
CURLOPT_ENCODING => "",
CURLOPT_MAXREDIRS => 10,
CURLOPT_TIMEOUT => 30,
CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
CURLOPT_CUSTOMREQUEST => "PUT",
CURLOPT_POSTFIELDS => json_encode([
'expires_at' => '2023-11-07T05:31:56Z'
]),
CURLOPT_HTTPHEADER => [
"Authorization: Bearer <token>",
"Content-Type: application/json"
],
]);
$response = curl_exec($curl);
$err = curl_error($curl);
curl_close($curl);
if ($err) {
echo "cURL Error #:" . $err;
} else {
echo $response;
}package main
import (
"fmt"
"strings"
"net/http"
"io"
)
func main() {
url := "https://{host}/api/llm-gateway/admin/api-keys/{id}/expiry"
payload := strings.NewReader("{\n \"expires_at\": \"2023-11-07T05:31:56Z\"\n}")
req, _ := http.NewRequest("PUT", url, payload)
req.Header.Add("Authorization", "Bearer <token>")
req.Header.Add("Content-Type", "application/json")
res, _ := http.DefaultClient.Do(req)
defer res.Body.Close()
body, _ := io.ReadAll(res.Body)
fmt.Println(string(body))
}HttpResponse<String> response = Unirest.put("https://{host}/api/llm-gateway/admin/api-keys/{id}/expiry")
.header("Authorization", "Bearer <token>")
.header("Content-Type", "application/json")
.body("{\n \"expires_at\": \"2023-11-07T05:31:56Z\"\n}")
.asString();require 'uri'
require 'net/http'
url = URI("https://{host}/api/llm-gateway/admin/api-keys/{id}/expiry")
http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true
request = Net::HTTP::Put.new(url)
request["Authorization"] = 'Bearer <token>'
request["Content-Type"] = 'application/json'
request.body = "{\n \"expires_at\": \"2023-11-07T05:31:56Z\"\n}"
response = http.request(request)
puts response.read_body{
"created_at": "2023-11-07T05:31:56Z",
"created_by_user_id": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
"id": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
"key_prefix": "<string>",
"kind": "user",
"name": "<string>",
"org_id": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
"scopes": [
"<string>"
],
"disabled_at": "2023-11-07T05:31:56Z",
"expires_at": "2023-11-07T05:31:56Z",
"group_name": "<string>",
"last_used_at": "2023-11-07T05:31:56Z",
"previous_key_expires_at": "2023-11-07T05:31:56Z",
"revoked_at": "2023-11-07T05:31:56Z",
"rotated_at": "2023-11-07T05:31:56Z",
"user_id": "3c90c3cc-0d44-4b50-8888-8dd25736052a"
}Authorizations
A Barndoor API key, sent as Authorization: Bearer <key>. Keys are prefixed bdai_ and are opaque — do not attempt to decode one. Interchangeable with an OAuth 2.0 access token.
Path Parameters
Identifier, a UUID
Body
Body of PUT /admin/api-keys/{id}/expiry (BCP-5209).
The new expiry. null removes it, so the key never expires. Must be in
the future. Required: a missing field is a 400 rather than a silent
"never expires".
Response
The updated record
Category of credential (BCP-3510). Set at insert, never updated.
user, machine, agent_session When this key was temporarily disabled. Unlike revoked_at this is
reversible: the auth path rejects the key while set, but re-enabling
(clearing it) restores access without re-issuing the secret.
Optional explicit IdP group binding for this key. NULL means no explicit group; the key still inherits the assigned user's IdP groups at request time for governance scope matching.
When this key last authenticated a request. None means it has never
been used. Updated best-effort and throttled on the auth path (see
touch_last_used), so it is accurate to within last_used_min_interval.
End of the grace period granted by the last rotation: until then the
previous secret still authenticates as this key. None, or a time in
the past, means only the current secret works.
When the secret was last replaced in place (BCP-5195). None means the
key still carries the secret it was created with.