# Update a Secret Key `POST /v2/secret-keys/{id}` Core API v2, Secret Keys. Update an existing Secret Key by its ID **Authentication:** Send `Authorization: Bearer `. To authenticate, generate a Secret API Key from your ODUS Dashboard and include it in the `Authorization` header as follows: `Authorization: Bearer ` ## Parameters ### Path parameters - `id` (string, required) ## Request body Content type `application/json`, required. Type: object (UpdateSecretKeyRequestDTO). - `note` (string): A user-provided note to help identify this secret key. Example: `Production backend key`. - `permissions` (array of string): Permissions granted to this secret key, controlling which API operations it can perform. Each item: One of `customer:read`, `customer:create`, `customer:update`, `customer:manage_restrictions`, `payment:read`, `payment:create`, `payment:authorize`, `payment:update`, `payment:capture`, `payment:reverse`, `payment:record_chargeback`, `payment:create_apple_pay_session`, `price:read`, `price:create`, `price:update`, `price:delete`, `job:read`, `product:read`, `product:create`, `product:update`, `secret_key:read`, `secret_key:create`, `secret_key:update`, `secret_key:delete`, `publishable_key:read`, `publishable_key:roll`, `publishable_key:update`, `invoice:read`, `invoice:void`, `gateway_profile:read`, `gateway_profile:create`, `gateway_profile:update`, `gateway_operation:read`, `customer_blacklist:read`, `customer_blacklist:create`, `customer_blacklist:delete`, `payment_method:read`, `request_log:read`, `cascade:read`, `cascade:create`, `cascade:update`, `route:read`, `route:create`, `route:update`, `webhook_subscriber:read`, `webhook_subscriber:create`, `webhook_subscriber:update`, `retry_policy:read`, `retry_policy:create`, `retry_policy:update`, `user:read`, `user:create`, `user:update`, `user:delete`, `subscription:read`, `subscription:cancel`, `subscription:resume`, `subscription:force_bill`, `subscription:preview`, `subscription:update`, `checkout_profile:read`, `checkout_profile:create`, `checkout_profile:update`, `merchant_config:read`, `merchant_config:update`, `search:read`, `report:read`. ## Responses ### `200` OK Type: object (SecretKeyDTO). - `createdAt` (string (date-time), required): The date and time when the entity was created. Example: `2024-02-18T12:00:00Z`. - `updatedAt` (string (date-time), required, nullable): The date and time when the entity was last updated. Example: `2024-02-21T12:15:00Z`. - `metadata` (map of string to string, nullable): Metadata used by merchants to store additional information about the entity. - `id` (string, required): Unique identifier of the secret key. Example: `skey_2R6lBd1IxNUPqtsQLcJU2PFtyAD`. - `maskedValue` (string, required): Masked representation of the secret key, showing only the last four characters. Example: `sk_****...a1b2`. - `note` (string, required, nullable): User-provided note for identifying this secret key. Example: `Production backend key`. - `permissions` (array of string, required): Permissions of the secret key. Each item: One of `customer:read`, `customer:create`, `customer:update`, `customer:manage_restrictions`, `payment:read`, `payment:create`, `payment:authorize`, `payment:update`, `payment:capture`, `payment:reverse`, `payment:record_chargeback`, `payment:create_apple_pay_session`, `price:read`, `price:create`, `price:update`, `price:delete`, `job:read`, `product:read`, `product:create`, `product:update`, `secret_key:read`, `secret_key:create`, `secret_key:update`, `secret_key:delete`, `publishable_key:read`, `publishable_key:roll`, `publishable_key:update`, `invoice:read`, `invoice:void`, `gateway_profile:read`, `gateway_profile:create`, `gateway_profile:update`, `gateway_operation:read`, `customer_blacklist:read`, `customer_blacklist:create`, `customer_blacklist:delete`, `payment_method:read`, `request_log:read`, `cascade:read`, `cascade:create`, `cascade:update`, `route:read`, `route:create`, `route:update`, `webhook_subscriber:read`, `webhook_subscriber:create`, `webhook_subscriber:update`, `retry_policy:read`, `retry_policy:create`, `retry_policy:update`, `user:read`, `user:create`, `user:update`, `user:delete`, `subscription:read`, `subscription:cancel`, `subscription:resume`, `subscription:force_bill`, `subscription:preview`, `subscription:update`, `checkout_profile:read`, `checkout_profile:create`, `checkout_profile:update`, `merchant_config:read`, `merchant_config:update`, `search:read`, `report:read`. ### `202` The merchant is entitled but its environment is not provisioned yet. Provisioning has been kicked off (exactly once) and is in progress; retry the request — it succeeds once the environment is ready. Returned only for identity-token (dashboard) requests bound to a merchant, not for secret-key API calls; any such endpoint can return it while provisioning is underway. Type: object (ProvisioningInProgress). - `status` (string, required): Signals the merchant environment is still being provisioned. One of `provisioning`. - `merchantAccountId` (string, required): The merchant account whose environment is being provisioned. Example: `dAI3aa87ROOeupeBCjNSKCOBOisBCYjB`. ### Errors - `400`: The request was rejected. `type` is `invalid_request_error` when the request itself is at fault — `errors` then lists every problem found, with field-attributable entries prefixed by the field’s path; or `invalid_state_error` when the request was well-formed but the resource is not in a state that allows it. - `401`: No API key was supplied, or the key is not valid. `type` is `authentication_error`. - `403`: The API key is valid but lacks the permission this operation requires. `type` is `permission_error`. - `404`: No resource exists with the requested identifier. `type` is `not_found_error`. - `409`: `type` is `conflict_error`. The supplied `X-Idempotency-Key` was already used with a different request body (`code` is `idempotency_conflict`, and retrying will not help), or the resource is being modified by another in-flight request (`code` is `resource_locked`, and retrying with backoff will). - `429`: Too many requests. A limit applies per operation; requests to other operations are unaffected. `type` is `rate_limit_error`. Use the `Retry-After-global` header to know when to retry. - `500`: The request could not be completed because of an unexpected error. `type` is `api_error`. - `503`: The request could not be served right now: the API is temporarily at capacity, or a dependency needed to authorize the request is unavailable — the auth service that verifies credentials, or the entitlement lookup behind it. `type` is `api_error`. It is raised before the operation runs, so the request had no effect, and unlike a plain 500 the condition is transient: retry with backoff. - `504`: The request exceeded the processing time limit and was abandoned. `type` is `api_error` and `code` is `timeout` — unlike a plain 500 the request may still have taken effect, so retry with the same idempotency key rather than blindly. Every error response has the same body: see [Errors](https://docs.odus.com/docs/guides/api-features/errors.md). --- Generated from the Core API v2 OpenAPI document, https://api.odus.com/openapi.v2.json. Interactive page: https://docs.odus.com/docs/api/core/v2/secret-key-controller-update