Update Consumer Access to an API Proxy

Endpoint

PUT /apiops/projects/{projectName}/consumers/{consumerKey}/access/api-proxies/{apiProxyName}

Authentication

Requires a Personal API Access Token.

Authorization: Bearer YOUR_TOKEN

Request

Path Parameters

Parameter	Type	Required	Description
projectName	string	Yes	Project name
consumerKey	string	Yes	Consumer key, assigned by the installation. Returned as consumerKey by every consumer response
apiProxyName	string	Yes	Name of the API proxy in the project

Request Body

All fields are optional.

{
  "expireTime": "2027-12-31T23:59:59.000Z",
  "environments": [
    { "environmentName": "test", "enabled": false }
  ],
  "disallowedEndpoints": [
    { "name": "/orders", "httpMethod": "DELETE" }
  ]
}

Field	Type	Description
expireTime	timestamp	New expiry of the grant. When you omit it, the stored expiry stays
environments	array	Environments to set, by name. Each item has environmentName and enabled. An environment you list is set. An environment you do not list keeps its stored value
disallowedEndpoints	array	Endpoints of the API proxy that the consumer may not call. Each item has name (REST path or SOAP operation) and httpMethod. A list you send replaces the stored list. An empty list clears it. When you omit the field, the stored list stays

name and type are accepted when they match the path. A different value answers 400 immutableField.

This operation edits the direct grant of the consumer. A grant that comes from an API product subscription is not edited here. When the consumer has no direct grant to the target, the request answers 404 resourceNotFound (params.reason = accessNotGranted). To create the grant, use Grant Consumer Access.

Response

200 OK.

The response is a write response. runtimeDeployment.state is IN_SYNC when every environment acknowledged the change, or DEGRADED when the change is stored but at least one environment did not acknowledge it. Do not retry a DEGRADED write; redeploy instead. resourceVersion is not returned.

result is the access row after the change, in the shape that List Consumer Access returns.

Errors

Status	Error key	Cause
400	malformedRequest	An environment entry has no environmentName (params.reason = environmentNameRequired), or an endpoint entry has no name or httpMethod (params.reason = nameAndHttpMethodRequired), or disallowedApiProxies is sent (params.reason = apiProxyGroupOnly)
400	immutableField	name or type differs from the path
404	resourceNotFound	The target is unknown in the project
404	resourceNotFound	The consumer has no direct grant to the target (params.reason = accessNotGranted)
404	resourceNotFound	An environment, an endpoint or a restricted API proxy is unknown. params.reason is environmentNotFound, endpointNotFound or apiProxyNotInGroup

cURL Example

curl -X PUT \
  "https://demo.apinizer.com/apiops/projects/MyProject/consumers/CONSUMER_KEY/access/api-proxies/NAME" \
  -H "Authorization: Bearer YOUR_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{   "expireTime": "2027-12-31T23:59:59.000Z",   "environments": [     { "environmentName": "test", "enabled": false }   ],   "disallowedEndpoints": [     { "name": "/orders", "httpMethod": "DELETE" }   ] }'

Permissions

• User must have IDENTITY + MANAGE permission in the project
• A project outside the scope of the caller answers 404 resourceNotFound, never 403
• The admin project has no consumers: a call on it answers 400 malformedRequest (params.reason = platformScopeNotSupported)

Related Documentation

• List Consumer Access
• Grant Consumer Access