Authenticate with an Organization Admin User API key, sent in the skyfire-api-key header. Keys belonging to Organization Admins are accepted; a MEMBER key, or any Agent API key, is rejected with 401.

The user must belong to your organization and be active: an unknown user returns 404 and a deactivated user returns 400. The agent must belong to that user; otherwise 404. All body fields are optional and only the fields you send are changed. The response is 204 No Content.

Grouped agents are managed through their group

An agent that is a user's instance of an agent group cannot be changed here, and returns 400. Rename it by renaming the group with Update Agent Group; deactivate it with Unenroll User from Agent Group; reactivate by enrolling again. This also applies to an instance whose user has already been unenrolled.

Renaming

displayName must be printable ASCII, 1 to 100 characters, with at least one non-space character. Names are compared case-insensitively with whitespace trimmed and collapsed. The new name must be free among the user's active agents, and may not match an active agent group in your organization. Either collision returns 409. Tokens minted afterwards carry the new name as aid.name; keys cache their agent for up to 60 seconds, so a token minted within a minute of the rename may still show the old name.

Deactivating and reactivating

active: false deactivates the agent: its API keys stop authenticating and every card enrolled on it is removed at the card network. The wallet is kept, so any remaining balance stays reachable. Repeating a deactivation is safe and finishes any card removal that failed.

active: true reactivates the agent. Its existing API keys work again. Cards are not restored and must be enrolled again. Because a deactivated agent's name is not reserved, reactivation re-checks the name and returns 409 if another active agent or group has since taken it. A deactivated buyer agent still counts as the user's one ungrouped buyer, so reactivate it rather than creating another.