# Update a management client

`PATCH /v1/management-clients/{application_id}` · permission `management-clients:write`

Updates a management client record with a JSON merge patch (RFC 7396, `application/merge-patch+json`): the fields you send change, the others stay. `If-Match` is required: without it the request fails with `428`, and with a version that no longer matches it fails with `412`. Only an API key can call this endpoint.

## Request

| Parameter | In | Description |
|---|---|---|
| `application_id` | path | Application ID (`app_…`). |
| `If-Match` | header | The `ETag` from the last read or write. |

Body: any of the fields below.

| Field | Type | Required | Description |
|---|---|---|---|
| `permissions` | string[] | no | 1-200 known `<resource>:<action>` permissions. Replaces the list as a whole; it cannot be `null`. |
| `allowed_cidrs` | string[] \| null | no | Up to 20 CIDR blocks. Replaces the list as a whole; `null` or `[]` uses the calling key's own list. |

A patch that changes nothing leaves the record, its version and the audit log as they are. A restricted key cannot change a record that is broader than itself (`403 permission_escalation`).

## Response

`200 OK`, with the new `ETag`.

```json
{
  "application_id": "app_01h455vb4pex5vsknk084sn02q",
  "permissions": ["users:read"],
  "allowed_cidrs": ["203.0.113.0/24"]
}
```

## Errors

| HTTP | code | When |
|---|---|---|
| 400 | `unknown_field` | The patch contains a field other than `permissions` and `allowed_cidrs`. |
| 403 | `permission_escalation` | The record, or the patched record, is broader than the calling key. |
| 404 | `not_found` | The application has no record in this environment. |
| 412 | `precondition_failed` | `If-Match` does not match the current version. |
| 415 | `unsupported_media_type` | The content type is not `application/merge-patch+json`. |
| 422 | `validation_failed` | `permissions` is `null`, empty or contains an unknown permission, or a CIDR is invalid. |
| 428 | `precondition_required` | `If-Match` is missing. |

## Example

```bash
curl -X PATCH https://api.eu.keenauth.com/v1/management-clients/app_01h455vb4pex5vsknk084sn02q \
  -H "Authorization: Bearer $KEENAUTH_SECRET_KEY" \
  -H "Content-Type: application/merge-patch+json" \
  -H 'If-Match: "3f2a9c0d7b1e4a6f8c5d2e1b0a9f8e7d"' \
  -d '{"permissions":["users:read"]}'
```

CLI: `keenauth management-clients update app_01h455vb4pex5vsknk084sn02q --permissions users:read --if-match '"3f2a9c0d7b1e4a6f8c5d2e1b0a9f8e7d"'`