BillOS v1
Console llms.txt OpenAPI
PATCH/keys/{id}

Pin a key to your servers

PATCH /keys/{id}

Requires the businesses scope.

Sets allowedCidrs on one of your keys: IPv4/IPv6 addresses or CIDRs (up to 20) the key may be used from; requests from anywhere else are refused with 403 forbidden. An empty list clears the restriction. Setting a list on the key you are calling with that excludes the address you are calling from is refused (validation), so you cannot lock yourself out by accident. The only field a consumer may change on a key; minting and revoking stay with BillOS.

Path parameters

NameTypeDescription
idstringrequiredAPI key id.

Body

FieldTypeDescription
allowedCidrsarray of stringrequirede.g. ["203.0.113.10", "198.51.100.0/24", "2001:db8::/32"]

Response

200: { "ok": true, … }

FieldTypeDescription
okbooleanrequired
keyApiKeyrequiredOne of the keys under your client. Never the hash. current marks the key this request used.

Errors: 400, 401, 403, 404, 429. Every failure answers { "error", "reason", "hint", "param", "doc_url", "retryable", "request_id" }: branch on reason, and read hint for what to change (https://docs.billos.co.il/errors.md).

PreviousList your API keys NextYour API usage
On this page
Path parametersBodyResponse
PATCH /keys/{id} 
curl -X PATCH "$BASE/keys/$DOC_ID" \
  -H "X-Api-Key: $KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "allowedCidrs": []
  }'
const res = await fetch(`${BASE}/keys/${DOC_ID}`, {
  method: 'PATCH',
  headers: {
    'X-Api-Key': KEY,
    'Content-Type': 'application/json',
  },
  body: JSON.stringify({
    "allowedCidrs": []
  }),
})
const data = await res.json()
if (!data.ok) throw new Error(data.reason)
import requests
res = requests.patch(
    f"{BASE}/keys/{DOC_ID}",
    headers={"X-Api-Key": KEY},
    json={
      "allowedCidrs": []
    },
)
data = res.json()
Set BASE to https://api.billos.co.il/v1 and KEY to your bk_live_… key, or a bk_test_… key to run it against the sandbox.
Manage your businesses, keys and webhooks in the BillOS Console.