> ## Documentation Index > Fetch the complete documentation index at: https://docs.hyperprop.com/llms.txt > Use this file to discover all available pages before exploring further. # Update an API key > Rename an API key or replace its IP allowlist. **Admin only.** You normally do this in the dashboard. When `allowedIps` is set, requests that use the key from any other address are refused with `403 IP_NOT_ALLOWED`; the error message includes the address the request came from. `[]` removes the restriction. The change applies to every request within 30 seconds. Check the list before you save: if the address your backend calls from is not in it, the key stops working for that backend. The key's `scope` can't be changed; create a new key with the scope you need instead. ## OpenAPI ````yaml https://api.hyperprop.com/platform/openapi.json patch /v1/organization/api-keys/{keyId} openapi: 3.0.0 info: title: Hyperprop Platform API version: 1.0.0 description: >- REST API for the Hyperprop Trading Platform — provision evaluation and funded trading accounts, manage traders and plans, react to account lifecycle events via signed webhooks, and reconcile billing. Built for prop firms integrating from their own backend. Authentication, quick start, error handling, idempotency, pagination, custom metadata, webhooks, and the MCP connector are documented at https://docs.hyperprop.com. x-logo: url: https://app.hyperprop.com/logo-icon.svg altText: Hyperprop href: https://hyperprop.com servers: - url: https://api.hyperprop.com/platform description: Production security: [] tags: - name: Trading accounts description: Create, update, and inspect trading accounts. - name: Traders description: Look up and update the traders in your organization. - name: Trading plans description: Define the plans you sell. - name: Trading rules description: Define how accounts are evaluated. - name: Instruments description: >- The contracts your organization's accounts can trade, with their specifications. - name: Lockouts description: Pause and resume trading on an account. - name: Payouts description: Check payout eligibility and record payouts. - name: Purchases description: Purchases recorded for your organization. - name: Time Machine description: Restore accounts to an earlier trading day or instant. - name: Mass credit description: >- Credit back losses across many accounts after an incident, as background jobs you can follow, pause, export and reverse. - name: Webhooks description: Register webhook endpoints and inspect deliveries. - name: Events description: Your organization's event history and real-time event stream. - name: Reconciliation description: Balances, end-of-day snapshots, and fills for reconciliation. - name: Analytics description: Organization performance and plan economics. - name: Billing description: 'Your Hyperprop bill: activity, billing cycles, and forecasts.' - name: Team and roles description: Manage dashboard access for your staff. - name: API keys description: >- Manage your organization's API keys: rotation, read-only keys and IP allowlists. - name: Logs and health description: >- API request logs, the audit log, integration health, and idempotency key recovery. - name: Organization profile description: Your organization's profile and logo. - name: Support description: Open and follow up on support tickets. - name: Partner access description: >- Read a trader's journal as an approved partner app, with the trader's own key. paths: /v1/organization/api-keys/{keyId}: patch: tags: - API keys summary: Update an API key description: >- Rename an API key or replace its IP allowlist. **Admin only.** You normally do this in the dashboard. When `allowedIps` is set, requests that use the key from any other address are refused with `403 IP_NOT_ALLOWED`; the error message includes the address the request came from. `[]` removes the restriction. The change applies to every request within 30 seconds. Check the list before you save: if the address your backend calls from is not in it, the key stops working for that backend. The key's `scope` can't be changed; create a new key with the scope you need instead. operationId: patchV1OrganizationApikeysKeyid parameters: - description: API key ID (from the list endpoint) x-format: guid: true name: keyId in: path required: true schema: type: string requestBody: content: application/json: schema: $ref: '#/components/schemas/Model1648' responses: '200': description: API key updated content: '*/*': schema: $ref: '#/components/schemas/Model1651' '400': description: 'Not an IPv4/IPv6 address or CIDR block: 203.0.113.300' content: '*/*': schema: $ref: '#/components/schemas/Model1652' '401': description: Authentication required content: '*/*': schema: $ref: '#/components/schemas/Model11' '403': description: Access denied content: '*/*': schema: $ref: '#/components/schemas/Model74' '404': description: API key not found content: '*/*': schema: $ref: '#/components/schemas/Model1653' '500': description: An unexpected error occurred content: '*/*': schema: $ref: '#/components/schemas/Model6' security: - X-API-Key: [] components: schemas: Model1648: type: object properties: name: type: string description: New label for the key example: Production backend minLength: 1 maxLength: 100 allowedIps: $ref: '#/components/schemas/Model1647' Model1651: type: object properties: success: type: boolean example: true message: type: string example: >- API key updated. The change applies to every request within 30 seconds. data: $ref: '#/components/schemas/Model1650' Model1652: type: object properties: success: type: boolean description: Always false on errors example: false statusCode: type: number example: 400 error: type: string example: Bad Request message: type: string example: 'Not an IPv4/IPv6 address or CIDR block: 203.0.113.300' code: type: string description: Machine-readable error code — switch on this, not on message text example: INVALID_IP_ALLOWLIST Model11: type: object properties: success: type: boolean description: Always false on errors example: false statusCode: type: number example: 401 error: type: string example: Unauthorized message: type: string example: Authentication required code: type: string description: Machine-readable error code — switch on this, not on message text example: UNAUTHORIZED Model74: type: object properties: success: type: boolean description: Always false on errors example: false statusCode: type: number example: 403 error: type: string example: Forbidden message: type: string example: Access denied code: type: string description: Machine-readable error code — switch on this, not on message text example: FORBIDDEN Model1653: type: object properties: success: type: boolean description: Always false on errors example: false statusCode: type: number example: 404 error: type: string example: Not Found message: type: string example: API key not found code: type: string description: Machine-readable error code — switch on this, not on message text example: API_KEY_NOT_FOUND Model6: type: object properties: success: type: boolean description: Always false on errors example: false statusCode: type: number example: 500 error: type: string example: Internal Server Error message: type: string example: An unexpected error occurred code: type: string description: Machine-readable error code — switch on this, not on message text example: INTERNAL_ERROR Model1647: type: array description: >- Replaces the key's IP allowlist. Send `[]` to allow any address again. Up to 50 IPv4/IPv6 addresses or CIDR blocks. example: - 203.0.113.7/32 - 198.51.100.0/24 maxItems: 50 items: type: string maxLength: 64 x-convert: trim: true Model1650: type: object example: id: 77777777-7777-4777-8777-777777777777 name: Production backend keyPrefix: hp_live_a1b2c3d4 permissions: - read - write - admin scope: full allowedIps: - 203.0.113.7/32 - 198.51.100.0/24 isActive: true lastUsedAt: '2026-10-30T09:12:00.000Z' expiresAt: null createdAt: '2026-03-04T16:13:19.211Z' properties: id: type: string name: type: string keyPrefix: type: string permissions: $ref: '#/components/schemas/Model1649' scope: $ref: '#/components/schemas/scope' allowedIps: $ref: '#/components/schemas/allowedIps' isActive: type: boolean lastUsedAt: type: string expiresAt: type: string createdAt: type: string Model1649: type: array items: type: string scope: type: string description: >- `full`: read and write. `read_only`: `GET` requests only (and the trading stream token); anything else returns `403 READ_ONLY_KEY`. example: full enum: - full - read_only allowedIps: type: array description: >- IPv4/IPv6 addresses or CIDR blocks the key may be used from (up to 50). Requests from other addresses return `403 IP_NOT_ALLOWED`. Empty means any address. A single address is stored as `/32` (IPv4) or `/128` (IPv6). example: - 203.0.113.7/32 - 198.51.100.0/24 maxItems: 50 items: type: string maxLength: 64 x-convert: trim: true securitySchemes: X-API-Key: type: apiKey name: X-API-Key in: header description: >- Organization API key. Format: "hp_live_{key}". Organization admins manage the key in the dashboard. ```` ## Related topics - [Update a trader](https://docs.hyperprop.com/platform-api/traders/update-a-trader.md) - [Update a webhook](https://docs.hyperprop.com/platform-api/webhooks/update-a-webhook.md) - [Update a trading account](https://docs.hyperprop.com/platform-api/trading-accounts/update-a-trading-account.md) - [Update a custom role](https://docs.hyperprop.com/platform-api/team-and-roles/update-a-custom-role.md) - [Update a trading plan](https://docs.hyperprop.com/platform-api/trading-plans/update-a-trading-plan.md) This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.