Change what an app password covers — its label, address pattern, or protocols. The domain is fixed for the life of the password: repointing a live credential would hand its holder mail they were never granted, so create a new password instead.
HTTP: PATCH /api/app-passwords/{id}
app-password
res = mk.updateAppPassword("id" => "apw_6Kd3PqR7", "address" => "triage-*", "protocols" => ["imap", "api"], "label" => "triage bot")