# Pin a key to your servers

`PATCH /keys/{id}`

Requires the `businesses` scope.

Sets `allowedCidrs` on one of your keys: IPv4/IPv6 addresses or CIDRs (up to 20) the key may be used from; requests from anywhere else are refused with `403 forbidden`. An empty list clears the restriction. Setting a list on the key you are calling with that excludes the address you are calling from is refused (`validation`), so you cannot lock yourself out by accident. The only field a consumer may change on a key; minting and revoking stay with BillOS.

## Path parameters

| Name | Type | | Description |
|---|---|---|---|
| `id` | string | **required** | API key id. |

## Body

| Field | Type | | Description |
|---|---|---|---|
| `allowedCidrs` | array of string | **required** | e.g. `["203.0.113.10", "198.51.100.0/24", "2001:db8::/32"]` |

## Response

`200`: `{ "ok": true, … }`

| Field | Type | | Description |
|---|---|---|---|
| `ok` | boolean | **required** |  |
| `key` | ApiKey | **required** | One of the keys under your client. Never the hash. `current` marks the key this request used. |

Errors: `400`, `401`, `403`, `404`, `429`. Every failure answers `{ "error", "reason", "hint", "param", "doc_url", "retryable", "request_id" }`: branch on `reason`, and read `hint` for what to change (https://docs.billos.co.il/errors.md).

## Examples

### cURL

```bash
curl -X PATCH "$BASE/keys/$DOC_ID" \
  -H "X-Api-Key: $KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "allowedCidrs": []
  }'
```
### Node

```node
const res = await fetch(`${BASE}/keys/${DOC_ID}`, {
  method: 'PATCH',
  headers: {
    'X-Api-Key': KEY,
    'Content-Type': 'application/json',
  },
  body: JSON.stringify({
    "allowedCidrs": []
  }),
})
const data = await res.json()
if (!data.ok) throw new Error(data.reason)
```
### Python

```python
import requests
res = requests.patch(
    f"{BASE}/keys/{DOC_ID}",
    headers={"X-Api-Key": KEY},
    json={
      "allowedCidrs": []
    },
)
data = res.json()
```