> ## Documentation Index
> Fetch the complete documentation index at: https://docs.tai42.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# Add/remove scopes on an api key

> Add and/or remove named scopes on a key's stored scope set without replacing the
whole set. The new set keeps the stored order, drops the removed scopes, then appends
the additions in the given order. A plain read-merge-write with NO new locking: two
simultaneous edits of one key can lose one (accepted for this surface).



## OpenAPI

````yaml /openapi.json post /api/auth/api-keys/{user_id}/scopes
openapi: 3.1.0
info:
  description: The operator HTTP surface served under /api/*.
  title: tai42-skeleton API
  version: 14.0.2
servers: []
security: []
paths:
  /api/auth/api-keys/{user_id}/scopes:
    post:
      tags:
        - access-control
      summary: Add/remove scopes on an api key
      description: >-
        Add and/or remove named scopes on a key's stored scope set without
        replacing the

        whole set. The new set keeps the stored order, drops the removed scopes,
        then appends

        the additions in the given order. A plain read-merge-write with NO new
        locking: two

        simultaneous edits of one key can lose one (accepted for this surface).
      operationId: post_api_auth_api_keys_user_id_scopes
      parameters:
        - in: path
          name: user_id
          required: true
          schema:
            type: string
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/KeyScopesModify'
        required: true
      responses:
        '200':
          content:
            application/json:
              schema:
                properties:
                  data:
                    $ref: '#/components/schemas/ScopesUpdateAck'
                required:
                  - data
                type: object
          description: Success.
        '400':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
          description: Malformed request.
        '401':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
          description: Missing or invalid api key.
        '403':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
          description: Forbidden.
        '404':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
          description: Resource not found.
        '501':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
          description: Error.
      security:
        - ApiKeyAuth: []
components:
  schemas:
    KeyScopesModify:
      description: >-
        Add and/or remove individual scopes on an api key — a granular edit that
        changes

        named scopes without replacing the whole set (the key ``edit`` door's
        ``scopes``

        field does a full replace).
      properties:
        add:
          items:
            type: string
          title: Add
          type: array
        remove:
          items:
            type: string
          title: Remove
          type: array
      title: KeyScopesModify
      type: object
    ScopesUpdateAck:
      description: Acknowledges a granular scope edit, returning the resulting scope set.
      properties:
        scopes:
          items:
            type: string
          title: Scopes
          type: array
        updated:
          title: Updated
          type: boolean
        user_id:
          title: User Id
          type: string
      required:
        - user_id
        - updated
        - scopes
      title: ScopesUpdateAck
      type: object
    Error:
      properties:
        code:
          description: >-
            Stable machine-readable reason a client keys a dedicated error state
            on, present on refusals that opt in (e.g. a 501 not-configured
            refusal). Optional: absent when the error carries only a
            human-readable message.
          type: string
        error:
          type: string
      required:
        - error
      type: object
  securitySchemes:
    ApiKeyAuth:
      in: header
      name: x-api-key
      type: apiKey

````