Edit an API key’s scopes

Replace the scopes on an existing (non-revoked) key in the caller org. Same rule as create — the caller may only grant scopes they themselves hold; any scope outside that set (including unknown scopes) is rejected. Empty scopes are rejected (revoke the key to disable it). Takes effect on the next request — scopes are resolved fresh per call, no cache.