> ## Documentation Index
> Fetch the complete documentation index at: https://apidoc.cometapi.com/llms.txt
> Use this file to discover all available pages before exploring further.
# Actualizar una API key
> Usa CometAPI PUT /api/token/ para actualizar una API key por ID con campos editables en el cuerpo JSON.
Usa este endpoint para actualizar el nombre, estado, cuota, vencimiento, restricciones de modelos, lista permitida de IP y configuración de grupo de una API key.
Genera un personal access token en [Console → Personal Settings](https://www.cometapi.com/console/personal), luego envíalo como el valor sin procesar del encabezado `Authorization`. No le antepongas `Bearer`.
Este endpoint usa `PUT /api/token/`, y el `id` pertenece al cuerpo JSON. Envía los campos editables que quieras conservar; los campos numéricos, booleanos o de cadena omitidos pueden restablecerse con la actualización.
## Cuerpo de la solicitud
| Field | Type | Description |
| ---------------------- | -------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| `id` | integer | Obligatorio. ID de la API key devuelto por [List API keys](./list-api-keys). |
| `name` | string | Nombre para mostrar legible por el usuario para la key. Debe tener 50 caracteres o menos. |
| `status` | integer | Estado operativo. `1` habilita la key para solicitudes de modelo. `2` la deshabilita. `3` la marca como expirada. `4` la marca con la cuota agotada. Las keys deshabilitadas, expiradas o agotadas son rechazadas por los endpoints de modelo. |
| `expired_time` | integer | Marca de tiempo Unix en segundos cuando expira la key. Usa `-1` para que no expire. Una marca de tiempo pasada bloquea las solicitudes de modelo. |
| `remain_quota` | integer | Cuota restante en unidades internas de cuota de CometAPI. Si esto llega a `0` y `unlimited_quota` es `false`, las solicitudes de modelo con esta key se rechazan por cuota agotada. |
| `unlimited_quota` | boolean | Indica si la key omite las comprobaciones de cuota restante. Establece `true` solo cuando la key deba seguir funcionando incluso si `remain_quota` es `0`. |
| `model_limits_enabled` | boolean | Indica si se debe restringir esta key a modelos específicos. Cuando es `false`, `model_limits` se ignora. |
| `model_limits` | string | model IDs separados por comas permitidos por esta key cuando `model_limits_enabled` es `true`. Usa los model IDs devueltos por `/v1/models`; usa una cadena vacía para no aplicar restricción de modelo. |
| `allow_ips` | string or null | Lista permitida de IP opcional. Proporciona una cadena JSON con entradas separadas por caracteres de nueva línea (`\n`). Cada entrada puede ser una sola dirección IPv4, una sola dirección IPv6, un CIDR IPv4 o un CIDR IPv6. Usa `null` o `""` para desactivar las restricciones de IP. |
| `group` | string | Restricción opcional de grupo de cuenta. Usa una cadena vacía para no establecer un grupo explícito. Los valores no vacíos deben estar disponibles para la cuenta, o la API devuelve `success: false`. |
| `cross_group_retry` | boolean | Indica si el reintento entre grupos está habilitado para el enrutamiento automático de grupos. Esto solo tiene sentido cuando la key usa un grupo con enrutamiento automático. |
## Formato de la lista permitida
Para permitir múltiples IP o rangos CIDR, envíalos como una cadena JSON con `\n` entre las entradas:
```json theme={null}
{
"allow_ips": "198.51.100.10\n203.0.113.0/24\n2001:db8::/32"
}
```
Este ejemplo permite una dirección IPv4, un rango CIDR IPv4 y un rango CIDR IPv6.
## OpenAPI
````yaml api/openapi/api-keys/update-api-key.openapi.json PUT /api/token/
openapi: 3.1.0
info:
title: Update API Key
version: 1.0.0
servers:
- url: https://api.cometapi.com
security:
- accessTokenAuth: []
paths:
/api/token/:
put:
summary: Update an API key
description: >-
Update an API key by sending its ID and editable fields in the JSON
body. This endpoint behaves like a full update: send fields you want to
preserve because omitted numeric, boolean, or string fields can be
reset.
operationId: updateApiKey
requestBody:
required: true
content:
application/json:
schema:
$ref: '#/components/schemas/UpdateApiKeyRequest'
examples:
default:
summary: Update an API key
value:
id: 1234
name: production-renamed
status: 1
expired_time: -1
remain_quota: 100000
unlimited_quota: false
model_limits_enabled: false
model_limits: ''
allow_ips: null
group: ''
cross_group_retry: false
with_ip_allowlist:
summary: Configure an IP allowlist
description: >-
Use one JSON string and separate multiple IP or CIDR entries
with `\n`.
value:
id: 1234
name: production-renamed
status: 1
expired_time: -1
remain_quota: 100000
unlimited_quota: false
model_limits_enabled: false
model_limits: ''
allow_ips: |-
198.51.100.10
203.0.113.0/24
2001:db8::/32
group: ''
cross_group_retry: false
responses:
'200':
description: Updated API key record.
content:
application/json:
schema:
type: object
required:
- success
- message
- data
properties:
success:
type: boolean
message:
type: string
data:
$ref: '#/components/schemas/ApiKey'
examples:
success:
summary: Updated
value:
success: true
message: ''
data:
id: 1234
user_id: 5678
key: $COMETAPI_KEY
status: 1
name: production-renamed
created_time: 1766102400
accessed_time: 1766102400
expired_time: -1
remain_quota: 100000
unlimited_quota: false
model_limits_enabled: false
model_limits: ''
allow_ips: null
used_quota: 0
group: ''
cross_group_retry: false
name_too_long:
summary: Name too long
value:
success: false
message: token name is too long
x-codeSamples:
- lang: curl
label: cURL
source: |-
curl -X PUT https://api.cometapi.com/api/token/ \
-H "Authorization: your-access-token" \
-H "Content-Type: application/json" \
-d '{
"id": 1234,
"name": "production-renamed",
"status": 1,
"expired_time": -1,
"remain_quota": 100000,
"unlimited_quota": false,
"model_limits_enabled": false,
"model_limits": "",
"allow_ips": null,
"group": "",
"cross_group_retry": false
}'
- lang: curl
label: cURL with IP allowlist
source: |-
curl -X PUT https://api.cometapi.com/api/token/ \
-H "Authorization: your-access-token" \
-H "Content-Type: application/json" \
-d '{
"id": 1234,
"name": "production-renamed",
"status": 1,
"expired_time": -1,
"remain_quota": 100000,
"unlimited_quota": false,
"model_limits_enabled": false,
"model_limits": "",
"allow_ips": "198.51.100.10\n203.0.113.0/24\n2001:db8::/32",
"group": "",
"cross_group_retry": false
}'
components:
schemas:
UpdateApiKeyRequest:
type: object
required:
- id
properties:
id:
type: integer
description: >-
Numeric API key ID returned by the list endpoint. For updates, send
this value in the JSON body, not in the URL.
example: 1234
name:
type: string
maxLength: 50
description: >-
User-readable display name for the API key. The backend accepts up
to 50 Unicode characters; longer names return `success: false` with
`token name is too long`.
example: production
status:
type: integer
description: >-
Operational status for the key. `1` enables the key for model
requests, `2` disables it, `3` marks it expired, and `4` marks it
quota exhausted. Disabled, expired, or exhausted keys are rejected
by model endpoints.
enum:
- 1
- 2
- 3
- 4
example: 1
expired_time:
type: integer
description: >-
Unix timestamp in seconds when the key expires. Use `-1` for no
expiration. A past timestamp blocks model requests with this key.
example: -1
remain_quota:
type: integer
description: >-
Remaining quota to assign to the key in CometAPI internal quota
units. If this reaches `0` while `unlimited_quota` is `false`, model
requests with this key are rejected as quota exhausted.
example: 100000
unlimited_quota:
type: boolean
description: >-
Whether the key bypasses remaining-quota checks. Set `true` only
when the key should keep working even if `remain_quota` is `0`.
example: false
model_limits_enabled:
type: boolean
description: >-
Whether to restrict this key to specific models. When `true`, only
model IDs listed in `model_limits` are allowed. When `false`,
`model_limits` is ignored.
example: false
model_limits:
type: string
description: >-
Comma-separated model IDs allowed by this key when
`model_limits_enabled` is `true`. Use model IDs returned by
`/v1/models`, for example `,`. Use an empty
string for no model restriction.
example: ''
allow_ips:
type:
- string
- 'null'
description: >-
Optional IP allowlist. Provide one JSON string with entries
separated by newline characters (`\n`). Each entry can be a single
IPv4 address, single IPv6 address, IPv4 CIDR, or IPv6 CIDR. Example
for three allowlist entries:
`198.51.100.10\n203.0.113.0/24\n2001:db8::/32`. CometAPI compares
the model request client IP to this list. Use `null` or `""` to
disable IP restrictions.
example: |-
198.51.100.10
203.0.113.0/24
2001:db8::/32
group:
type: string
description: >-
Optional account group restriction. Use an empty string for no
explicit group restriction. Non-empty values must be available to
the account, or the API returns `success: false` with a `no access
to group` message.
example: ''
cross_group_retry:
type: boolean
description: >-
Whether cross-group retry is enabled for automatic group routing.
This is only meaningful when the key uses an auto-routed group such
as `auto`.
example: false
additionalProperties: false
ApiKey:
type: object
properties:
id:
type: integer
description: >-
Numeric API key ID. Use this value with the get, update, and delete
endpoints.
example: 1234
user_id:
type: integer
description: Account user ID that owns the key.
example: 5678
key:
type: string
description: >-
API key value returned by the management API. Treat it as a secret
and use it as `Authorization: Bearer $COMETAPI_KEY` for model
requests.
example: $COMETAPI_KEY
status:
type: integer
description: >-
Operational status for the key. `1` means enabled, `2` disabled, `3`
expired, and `4` exhausted. Only enabled keys are accepted by model
endpoints.
enum:
- 1
- 2
- 3
- 4
example: 1
name:
type: string
description: User-readable display name for the API key.
example: production
maxLength: 50
created_time:
type: integer
description: Unix timestamp in seconds when the key was created.
example: 1766102400
accessed_time:
type: integer
description: >-
Unix timestamp in seconds when the key was last used. Newly created
keys may show the creation time until first use.
example: 1766102400
expired_time:
type: integer
description: >-
Unix timestamp in seconds when the key expires. `-1` means no
expiration.
example: -1
remain_quota:
type: integer
description: >-
Remaining quota for this key in CometAPI internal quota units. When
this reaches `0` and `unlimited_quota` is `false`, model requests
are rejected as quota exhausted.
example: 100000
unlimited_quota:
type: boolean
description: Whether the key bypasses remaining-quota checks.
example: false
model_limits_enabled:
type: boolean
description: >-
Whether model restrictions are active for this key. When `false`,
`model_limits` is ignored.
example: false
model_limits:
type: string
description: >-
Comma-separated model IDs allowed by this key when
`model_limits_enabled` is `true`. Empty means no configured model
list.
example: ''
allow_ips:
type:
- string
- 'null'
description: >-
Optional IP allowlist stored as one newline-separated string. Each
entry can be a single IPv4 address, single IPv6 address, IPv4 CIDR,
or IPv6 CIDR. Example:
`198.51.100.10\n203.0.113.0/24\n2001:db8::/32`. `null` or `""` means
IP restrictions are disabled.
example: |-
198.51.100.10
203.0.113.0/24
2001:db8::/32
used_quota:
type: integer
description: Quota already consumed by this key in CometAPI internal quota units.
example: 0
group:
type: string
description: >-
Account group restriction for this key. Empty means no explicit
group restriction.
example: ''
cross_group_retry:
type: boolean
description: >-
Whether cross-group retry is enabled for automatic group routing.
This is only meaningful when the key uses an auto-routed group such
as `auto`.
example: false
additionalProperties: true
securitySchemes:
accessTokenAuth:
type: apiKey
in: header
name: Authorization
description: >-
Personal access token copied from CometAPI Console > Personal Settings.
Send the raw token value; do not prefix it with `Bearer`.
````