Skip to main content
PATCH
cURL

Authorizations

Authorization
string
header
required

Send Authorization: Bearer <key>. Testnet: lum_test_…; Mainnet: lum_live_…. A key works only on its own network, so pick the server that matches it (the other network answers 401). Publishable lum_pub_… keys call the GET data routes only, from an allowed browser origin. Webhook keys (whk_…) are not accepted here.

Path Parameters

id
string<uuid>
required

API key ID: id from GET /v1/keys or from the create response. The example ID is a placeholder and answers 404: use your own.

Example:

"00000000-0000-4000-8000-000000000000"

Body

application/json
name
string

New label, 1 to 100 characters.

Required string length: 1 - 100
allowed_origins
string[]

Publishable keys only: a request must send an Origin header equal to one of these. HTTPS is required except http://localhost and http://127.0.0.1; no wildcards; at most 150 characters each.

Required array length: 1 - 20 elements

Exact origin, scheme://host[:port], normalized to lowercase without a default port.

rate_limit_per_minute_per_ip
integer

Publishable keys only: requests per minute per end-user IP (default 60). The organization plan limit still applies.

Required range: 1 <= x <= 600
monthly_credit_cap
integer | null

Publishable keys only: set a cap, or null to remove it.

Required range: 1 <= x <= 1000000000000

Response

The updated key metadata.

id
string<uuid>
required
name
string
required
key_prefix
string
required
network
enum<string>
required
Available options:
mainnet,
testnet
created_at
string<date-time>
required
access
enum<string>
required

full, read for data-only keys, or publishable for browser keys. Rotation keeps it (and a publishable key's origins and limits; its cap counter starts again), and a key created with an expiry passes the same lifetime, counted from the rotation, to its replacement.

Available options:
full,
read,
publishable
last_used_at
string<date-time>
revoked_at
string<date-time>
expires_at
string<date-time>

Set by a creation-time expiry or while a rotated key is in its overlap window. The key stops working at this time.

rotated_from
string<uuid>

The key this one replaced.

allowed_origins
string[]

Publishable keys only: a request must send an Origin header equal to one of these. HTTPS is required except http://localhost and http://127.0.0.1; no wildcards; at most 150 characters each.

Required array length: 1 - 20 elements

Exact origin, scheme://host[:port], normalized to lowercase without a default port.

rate_limit_per_minute_per_ip
integer

Publishable keys only: requests per minute per end-user IP (default 60). The organization plan limit still applies.

Required range: 1 <= x <= 600
monthly_credit_cap
integer

Publishable keys only: settled credits this key may use per billing period. At the cap the key gets 429 until the next period; other keys continue. Omitted when there is no cap.

Required range: 1 <= x <= 1000000000000