> ## Documentation Index > Fetch the complete documentation index at: https://docs.basaltic.sh/llms.txt > Use this file to discover all available pages before exploring further. # Update a log group > Mutate description, retention policy, KMS association, or tags. Name is immutable (rename = recreate). Requires `telemetry:UpdateLogGroup`. ## OpenAPI ````yaml /api-reference/specs/telemetry.yaml patch /v1/log-groups/{id} openapi: 3.0.3 info: title: Basaltic Telemetry API version: 1.0.0 description: | Regional telemetry API — log groups + log ingest/search, ClickHouse metrics (remote_write + structured query with Prometheus-compatible JSON envelopes), span ingest, and trace search/detail + per-account trace settings. contact: name: Basaltic Support email: ping@basaltic.sh license: name: Proprietary url: https://basaltic.sh/terms servers: - url: https://telemetry.{region}.basaltic.sh description: Regional API endpoint (one per region) variables: region: default: sa-saopaulo-1 description: Region code security: - SignatureAuth: [] paths: /v1/log-groups/{id}: patch: tags: - Telemetry summary: Update a log group description: | Mutate description, retention policy, KMS association, or tags. Name is immutable (rename = recreate). Requires `telemetry:UpdateLogGroup`. operationId: updateLogGroup parameters: - name: id in: path required: true schema: type: string format: uuid example: 4a7b2c8d-9e1f-4a2b-8c3d-5e6f7a8b9c0d requestBody: required: true content: application/json: schema: $ref: '#/components/schemas/UpdateLogGroupRequest' responses: '200': description: Updated log group content: application/json: schema: $ref: '#/components/schemas/LogGroupResponse' '400': $ref: '#/components/responses/BadRequest' '401': $ref: '#/components/responses/Unauthorized' '403': $ref: '#/components/responses/Forbidden' '404': $ref: '#/components/responses/NotFound' '500': $ref: '#/components/responses/InternalServerError' components: schemas: UpdateLogGroupRequest: type: object properties: description: type: string nullable: true example: Production API request logs (v2) retention_days: type: integer minimum: 1 maximum: 3650 description: 1..3650; pass clear_retention to switch to never expire example: 90 clear_retention: type: boolean description: When true, sets retention to never-expire (ignores retention_days) example: false kms_key_crn: type: string nullable: true description: Pass an empty string to disassociate example: >- crn:kms:sa-saopaulo-1:my-account:key/2f8a1c6e-4b3d-4e9f-a1b2-c3d4e5f60718 tags: type: object additionalProperties: type: string LogGroupResponse: type: object properties: log_group: $ref: '#/components/schemas/LogGroup' LogGroup: type: object properties: id: type: string format: uuid example: 4a7b2c8d-9e1f-4a2b-8c3d-5e6f7a8b9c0d crn: type: string description: CRN of the log group (used as the IAM resource ARN) example: crn:telemetry:sa-saopaulo-1:my-account:log-group/app-prod-api account_id: type: string format: uuid description: Owning account — the tenant fence for this group example: 9b2e4d11-6c3a-4f8e-bd47-1a2b3c4d5e6f name: type: string description: 1..512 chars, [A-Za-z0-9_./#-]. Leading "/" not allowed. example: app/prod/api description: type: string example: Production API request logs retention_days: type: integer nullable: true minimum: 1 maximum: 3650 description: 1..3650 days, or null for never expire example: 30 kms_key_crn: type: string description: KMS key associated with the group (empty = plaintext) example: >- crn:kms:sa-saopaulo-1:my-account:key/2f8a1c6e-4b3d-4e9f-a1b2-c3d4e5f60718 tags: type: object additionalProperties: type: string created_at: type: string format: date-time example: '2026-01-15T09:30:00Z' updated_at: type: string format: date-time example: '2026-01-15T09:30:00Z' Error: type: object required: - error properties: error: type: object required: - code - message - request_id properties: code: type: string description: Error code identifying the type of error example: INVALID_INPUT message: type: string description: Human-readable error message example: Invalid request parameters request_id: type: string format: uuid description: Request ID for debugging example: 550e8400-e29b-41d4-a716-446655440000 responses: BadRequest: description: Invalid request parameters content: application/json: schema: $ref: '#/components/schemas/Error' example: error: code: INVALID_INPUT message: Invalid request parameters request_id: 550e8400-e29b-41d4-a716-446655440000 Unauthorized: description: Authentication required or token invalid content: application/json: schema: $ref: '#/components/schemas/Error' example: error: code: UNAUTHORIZED message: Authentication required request_id: 550e8400-e29b-41d4-a716-446655440000 Forbidden: description: Insufficient permissions content: application/json: schema: $ref: '#/components/schemas/Error' example: error: code: ACCESS_DENIED message: You don't have permission to perform this action request_id: 550e8400-e29b-41d4-a716-446655440000 NotFound: description: Resource not found content: application/json: schema: $ref: '#/components/schemas/Error' example: error: code: NOT_FOUND message: Resource not found request_id: 550e8400-e29b-41d4-a716-446655440000 InternalServerError: description: Internal server error content: application/json: schema: $ref: '#/components/schemas/Error' example: error: code: INTERNAL_ERROR message: An internal error occurred request_id: 550e8400-e29b-41d4-a716-446655440000 securitySchemes: SignatureAuth: type: apiKey in: header name: Authorization description: > Request signing with an access key issued to a service account. An HMAC-SHA256 over a canonical form of the request, close to AWS SigV4. The `basaltic` CLI signs for you. Send `Authorization`, `X-Date` (UTC, `YYYYMMDDTHHMMSSZ`) and `X-Nonce` (random per request); add `X-Content-Sha256` to bind a body, and `X-Amz-Security-Token` when using temporary credentials. ``` Authorization: BASALTIC-HMAC-SHA256 Credential=///basaltic/basaltic_request, SignedHeaders=host;x-date;x-nonce, Signature= ``` `` is the region code you are calling, or `global` for the global services. A signature is valid for 5 minutes from `X-Date`, and mutating requests are replay-guarded on the nonce. **Full signing procedure, including a working implementation:** https://docs.basaltic.sh/authentication ## Rate limits There is no global request budget. A limit applies only where an operation documents a `429`, and that operation says what it counts. Those responses carry `X-RateLimit-Limit`, `X-RateLimit-Remaining`, `X-RateLimit-Reset` and, on a `429`, `Retry-After` — read them rather than hard-coding a number. Retrying before `Retry-After` is refused and extends the window. Everything else is bounded by quota, not by request rate. ````