# Update a public key

Updates name, isActive, or expiresAt. PEM / algorithm / kid changes require delete + re-create. Unknown fields are silently stripped.

Endpoint: PATCH /resources/tenants/api-tokens/v1/{apiTokenId}/public-keys/{keyId}
Version: 1.0
Security: bearer

## Path parameters:

  - `apiTokenId` (string, required)

  - `keyId` (string, required)

## Header parameters:

  - `frontegg-tenant-id` (string, required)
    The tenant ID identifier

## Request fields (application/json):

  - `name` (string)
    Human-readable label for this key

  - `isActive` (boolean)
    Whether this key is active. Omit to leave unchanged; new keys default to true on creation.

  - `expiresAt` (string,null)
    ISO 8601 expiry date; null removes the expiry

## Response 200 fields (application/json):

  - `id` (string, required)

  - `apiTokenId` (string, required)

  - `kid` (string, required)

  - `algorithm` (string, required)

  - `name` (string,null, required)

  - `publicKeyFingerprint` (string, required)
    SHA-256 hex fingerprint of the SubjectPublicKeyInfo DER

  - `isActive` (boolean, required)

  - `expiresAt` (string,null, required)

  - `createdByUserId` (string,null, required)

  - `createdAt` (string, required)

  - `updatedAt` (string, required)

  - `publicKeyPem` (string, required)
    PEM-encoded public key (SubjectPublicKeyInfo)