Update an MCP key

PUT/v1/mcp-keys/{id}

Update an MCP key.

A partial update of the name, tool allowlist and rate limits; clear_tool_allowlist and clear_rate_limits remove them. The secret is changed by rotating.

Requires an organization admin key, or a workspace admin key for the key's workspace. Returns 400 for an invalid allowlist entry. Returns 402 when the organization's plan does not include the MCP Gateway. Returns 404 when the key does not exist in the organization.

Authorization

AuthorizationBearer va_
A platform API key (va_...), created under Settings > API keys. Scoped to an organization or one workspace, with an admin or member role. Used by the management API.

Path parameters

idstring<uuid>required
The MCP key's ID (UUID).

Query parameters

organizationstringrequired
The organization's identifier (slug).

Request body application/json

the fields to change

namestring
New display name, up to 255 characters.
At least 0 characters · At most 255 characters
tool_allowliststring[]
Replaces the allowlist (same format as on create). An empty list allows no tool.
At most 500 items
clear_tool_allowlistboolean
true removes the allowlist: the key may call every tool the registry allows.
rate_limit_rpminteger<int32>
New per-minute limit (at least 1).
Minimum 1
rate_limit_rpdinteger<int32>
New per-day limit (at least 1).
Minimum 1
clear_rate_limitsboolean
true removes both of the key's own rate limits. A limit sent in the same request is then applied.

Responses

200application/json

idstring<uuid>
The key's ID (UUID), used in the API paths.
namestring
Display name.
organizationstring
The organization that owns it.
workspace_idstring<uuid>
The workspace it belongs to (UUID).
key_hintstring
The last four characters of the key.
statusstring
ACTIVE or REVOKED.
tool_allowliststring[]
The tools it may call ({server slug}/{tool name} or {server slug}/*). Absent: every tool the registry allows.
rate_limit_rpminteger<int32>
Gateway calls per minute. Absent: only the plan's per-workspace limit.
rate_limit_rpdinteger<int32>
Gateway calls per day. Absent: no daily limit of its own.
expires_atstring<date-time>
When it stops working (ISO 8601). Absent: never.
last_used_atstring<date-time>
When it was last used on the gateway (ISO 8601).
created_bystring
The user who created it.
created_atstring<date-time>
When it was created (ISO 8601).

Request

curl -X PUT "https://api.vectoraxis.ai/v1/mcp-keys/{id}?organization=string" \
  -H "Authorization: Bearer $VECTORAXIS_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
  "name": "string",
  "tool_allowlist": [
    "string"
  ],
  "clear_tool_allowlist": true,
  "rate_limit_rpm": 1,
  "rate_limit_rpd": 1,
  "clear_rate_limits": true
}'

VectorAxis is built by GK Labs, a member of NVIDIA Inception.