Updates a child API key. All fields are optional; at least one must be provided. line_id=null unbinds the key (wildcard / account-wide); a non-null line_id must point to a non-released line owned by the same user in the same environment, otherwise a 422 validation error is returned for the env mismatch and a 404 for missing/released lines.
permissions accepts the four customer-settable tiers (full, call_only, sms_only, read_only). The backfill-only legacy_full tier cannot be set via the API.
Service keys (sk_svc_*) authenticate the /v1/keys/* management plane. Send as Authorization: Bearer <service-key>. Service keys are minted only from the portal (Settings → Service Keys); there is no API path to mint another service key.
A child API key (sk_test_* / sk_live_*). Minted via the portal (UI) or programmatically via POST /v1/keys when authenticated as a service key.