update_virtual_key

What update_virtual_key does on Portkey Admin

AI agents use update_virtual_key to create or update resources in Portkey Admin, usually the action step of a workflow, after the agent has gathered context. Every call changes real data in your Portkey Admin environment.

Why update_virtual_key is rated Medium

This tool creates or modifies data reversibly (fitting the Write category). While not destructive, updating virtual keys—which are security credentials—poses significant risk if an AI agent misuses it to modify access controls, rotate keys for malicious purposes, or escalate privileges. Severity is high due to the security-critical nature of credential modification in an admin API context.

From the tool's definition Tool name 'update_virtual_key' and description 'Update a virtual key' indicate modification of existing data. Virtual keys in admin/security contexts are credentials or access tokens, making unauthorized updates a high-severity concern.

The rule that runs update_virtual_key safely

PolicyLayer is an MCP gateway: it sits between your AI agents and Portkey Admin, and checks every tool call against a rule you set before the call runs. Nothing changes on the server itself. For update_virtual_key, this is the rule to start with:

{
  "version": "1",
  "default": "deny",
  "tools": {
    "update_virtual_key": {
      "limits": [
        {
          "counter": "update_virtual_key_rate",
          "window": "minute",
          "max": 30,
          "scope": "grant"
        }
      ]
    }
  }
}

Questions about update_virtual_key