Update API key IP allowlist

PATCH 
/settings/keys/:id

Sets or clears the IP allowlist on an existing API key. The allowedIps field must be present in the body — a missing field is not treated as "clear the allowlist" ({} returns 400). Pass null or an empty string to remove the restriction; pass a comma-separated list of literal IPs and/or CIDR ranges to restrict the key.

The value is validated and normalized server-side before persistence. Cache entries for this key's IP-allow lookup are invalidated synchronously so the new policy takes effect on the next request.

Request

Responses

200

Allowlist updated

400

Invalid or missing body

401

Missing or invalid credentials

404

Key not found, revoked, or belongs to another tenant