Runs examples for real against your account. Test keys only; kept in this tab, never stored on our side. Get a key
ZapSMTP / Docs / API keys & SMTP credentials

Update an API key

PATCH/v1/api-keys/{id}

Rename a key or change its permission and restrictions. The token and the mode never change; the new rights apply to the next request.

Requires a full-access live key; test keys get 403 test_key_restricted.

Path parameters

idstringrequired
API key id.

Body parameters

namestring
1–100 characters.
permissionstring
One of full_access, sending_access.
domain_idstring | null
Restrict sending to one verified domain (sending access only). null lifts the restriction.
streamstring | null
Restrict to one stream. null lifts the restriction. One of transactional, broadcast.

Errors

key_restrictedHTTP 403
this API key expires, so the keys it manages must expire no later than it does | this API key is limited to the <stream> stream, and so are the keys it manages
test_key_restrictedHTTP 403
test-mode keys can send test email and read, not change the account: use a live key
not_foundHTTP 404
Unknown or revoked key.
invalid_parameterHTTP 422
Invalid name, permission or stream; domain_id with full access; unknown domain; "domain_id must be a string or null".
PATCH/v1/api-keys/{id}
curl -X PATCH 'https://zapsmtp.xyz/v1/api-keys/019a1f2e-7c3b-7d41-9a52-0c4b8e6f1a23' \
  -H "Authorization: Bearer $ZAP_API_KEY" \
  -H 'Content-Type: application/json' \
  -d '{
  "name": "checkout-service",
  "domain_id": "019a1e9b-41c2-7a0e-b5d1-3f6c2e8a9d47"
}'
Set ZAP_API_KEY in your environment.
Response 200 OK
{
  "id": "019a1c11-2f3e-7a4b-9c5d-6e7f8a9b0c1d",
  "name": "checkout-service",
  "prefix": "zap_8fK2mQ",
  "permission": "sending_access",
  "mode": "live",
  "stream": null,
  "expires_at": null,
  "domain_id": "019a1e9b-41c2-7a0e-b5d1-3f6c2e8a9d47",
  "last_used_at": "2026-10-22T09:12:00Z",
  "created_at": "2026-10-01T10:00:00Z"
}