> ## Documentation Index
> Fetch the complete documentation index at: https://www.unkey.com/docs/llms.txt
> Use this file to discover all available pages before exploring further.

> ## Agent Instructions
> Unkey is two separate products. Compute builds, deploys, and runs apps behind a gateway. API Management issues API keys, enforces rate limits, manages identities and permissions, and reports usage. Say which product a page belongs to; a reader can use either without the other.
> Every Unkey API endpoint is an HTTP POST to https://api.unkey.com/v2/{service}.{procedure} with a root key in the Authorization: Bearer header. Root keys are workspace scoped.
> Error codes have the form err:{system}:{category}:{specific} and each has a page at /errors/{system}/{category}/{specific}.
> The word environment means production or preview in Compute. Rate limiting has four meanings on this site; the glossary lists them.

# unkey root-keys update

> Change a root key's name, enabled state, or permission set.

> [!NOTE]
>
> Create a root key with the permissions listed on this page under **Root Keys** in the dashboard sidebar. CLI commands can instead use a session from [unkey login](https://www.unkey.com/docs/platform/cli/login.md) with the required permissions. See [Permission reference](https://www.unkey.com/docs/platform/root-keys/permissions-legacy.md) for every permission.

Update a root key in the authenticated workspace.
Requires `unkey:v1:<workspace_id>:rootKeys/<key_id>#write`.
Use `rootKeys/*#write` to update any root key in the workspace.

`permissions` replaces the complete permission set. Each permission must be a supported URN
in the authenticated workspace and within the caller's permissions.
An expiring root key can only update root keys that expire no later than itself.

Provide at least one of `--name`, `--enabled`, or `--permissions`. Omitted fields stay unchanged. An empty `--permissions=` removes all permissions. Use `--body` with `name: null` to remove the name.

## Usage

```bash theme={"system"}
unkey root-keys update --key-id=<key-id> [flags]
```

## Flags

**--enabled** `boolean`

Whether the root key can authenticate. Omit to keep the current state.

**--key-id** `string` *required*

Root key identifier returned by rootKeys.createKey or rootKeys.listKeys.

**--name** `string`

New root key name. Set null to remove the name. Omit to keep the current name. Use `--body` to send `name: null`. An empty string is not a valid name.

**--permissions** `string[]`

Complete replacement permission set. Every permission must be a supported URN in the authenticated workspace and within the caller's permissions. Omit to keep the current permissions. Pass comma-separated permission URNs. Pass `--permissions=` to remove every permission.

### Shared flags

These flags control authentication, requests, and output. [CLI output and shared flags](https://www.unkey.com/docs/platform/cli/output-and-flags.md) describes them in full.

**--body** `string`

A JSON document sent as the request body instead of building it from the flags above. It is mutually exclusive with the request-building flags, and unknown fields are rejected locally. See [Send a raw body](https://www.unkey.com/docs/platform/cli/output-and-flags.md#send-a-raw-body).

**--root-key** `string`

Root key used for the request. Falls back to `UNKEY_ROOT_KEY`, then stored credentials, including a CLI session. See [CLI authentication](https://www.unkey.com/docs/platform/cli/authentication.md) for the full precedence order.

**--api-url** `string` (default: [https://api.unkey.com](https://api.unkey.com))

Base URL of the API. Falls back to `UNKEY_API_BASE_URL`. You don't normally need to set it.

**--config** `string` (default: \~/.unkey/config.toml)

Path of the TOML config file. Falls back to `UNKEY_CONFIG`. An explicit `--config` takes precedence over a stored CLI session. Browser login stores a session, not a root key in this file. See [CLI authentication](https://www.unkey.com/docs/platform/cli/authentication.md).

**--output** `enum` (default: human)

Use `human` (default) for name-first summary tables and labeled details, or `json` for the unchanged full response envelope, including all fields and pagination. Terminal tables use relative timestamps and may shorten display names and descriptions, but never identifiers, slugs, or credentials. Redirected human output keeps complete values and uses RFC3339 UTC timestamps. Falls back to `UNKEY_OUTPUT`; other values are rejected. `--json` also selects JSON output. Add `--debug` to print the request ID to stderr. See [Output formats](https://www.unkey.com/docs/platform/cli/output-and-flags.md#output-formats).

**--debug** `boolean`

Print the successful response's request ID to stderr, separate from stdout.

**--json** `boolean`

Print the full response as JSON. Takes precedence over a valid `--output` or `UNKEY_OUTPUT` value.

## Examples

```bash theme={"system"}
unkey root-keys update --key-id=key_example --enabled=false
```

Send the request body as JSON:

```bash theme={"system"}
unkey root-keys update --body='{"keyId":"key_example","name":null,"permissions":[]}'
```

## API endpoint

The command calls `POST /v2/rootKeys.updateKey` and prints its response. See the [endpoint definition](https://github.com/unkeyed/unkey/blob/main/svc/api/openapi/spec/paths/v2/rootKeys/updateKey/index.yaml) for the HTTP contract. Request fields use camelCase in `--body`.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.