Update Consumer

Endpoint

PUT /apiops/projects/{projectName}/consumers/{consumerKey}

Authentication

Requires a Personal API Access Token.

Authorization: Bearer YOUR_TOKEN

Request

Headers

Header	Value	Required
Authorization	Bearer {token}	Yes
Content-Type	application/json	Yes

Path Parameters

Parameter	Type	Required	Description
projectName	string	Yes	Project name
consumerKey	string	Yes	Consumer key, assigned by the installation. Returned as consumerKey by every consumer response

Request Body

Send only the fields you want to change.

{
  "email": "updated@example.com",
  "ipList": [],
  "expireDate": null
}

The body has the same fields as Create Consumer, with these rules:

Value you send	Result
Field omitted, or null	The stored value stays
Empty list ([]) or empty string ("")	The stored value is cleared
"expireDate": null	The expiry is removed. This is the only field where an explicit null changes the value
metadata	Replaces the stored list. A secret entry that you send without a value is stored empty. Send the value to keep it
roleNameList	Replaces the stored roles. A name resolves in the project of the consumer first, then in the admin project. A role of another project is not resolved. An unknown role answers 400 malformedRequest (params.reason = unknownRole)

Fields that cannot change here

Field	Rule
username, consumerKey	Immutable. A different value answers 400 immutableField. The same value is accepted
password	Not accepted. Any value answers 400 malformedRequest (params.reason = useChangePasswordAction). Use Change Consumer Password
organizationCode	Must name the current organization. A different code answers 400 malformedRequest (params.reason = transfer.organizationChangeViaTransfer). Use the transfer action

Warning

A consumer that a live identity source manages (LDAP, OIDC, database or API sync) cannot be edited. The request answers 400 malformedRequest with params.reason = ldapManaged. Change such a consumer in the identity source. To switch it on or off, use Enable Consumer or Disable Consumer, which this rule does not cover.

Response

200 OK.

The response is a write response. result is the consumer. runtimeDeployment.state is IN_SYNC when every environment acknowledged the change, or DEGRADED when the change is stored but at least one environment did not acknowledge it. Do not retry a DEGRADED write; redeploy instead. resourceVersion is not returned.

An unknown consumerKey answers 404 resourceNotFound.

cURL Example

curl -X PUT \
  "https://demo.apinizer.com/apiops/projects/MyProject/consumers/CONSUMER_KEY" \
  -H "Authorization: Bearer YOUR_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{
    "email": "updated@example.com",
    "expireDate": null
  }'

Permissions

• User must have IDENTITY + MANAGE permission in the project
• A project outside the scope of the caller answers 404 resourceNotFound, never 403
• The admin project has no consumers: a call on it answers 400 malformedRequest (params.reason = platformScopeNotSupported)