In an active Thread network, network credentials are encapsulated in Operational Datasets.
For updating the Thread Master Key and PSKc via standard Thread mechanisms,
otDatasetSetPending is probably what you are looking for. otDatasetSetPending will set the Pending Dataset directly on the local device. OpenThread will then use its normal logic to resolve conflicts between the local datasets and the leader's datasets and attempt to register the new Pending Dataset with the leader.
If you have application-layer logic that can distribute the new network credentials (i.e. Operational Datasets) and apply them directly at the appropriate time, you can use
otDatasetSetActive directly to apply the updates immediately, even while the network is running. This may be beneficial to your use case if you have an application-layer way to securely communicate the new network credentials to each individual device. Of course, the downside is that arbitrary Thread 1.1.1 devices that do not have your custom logic will not be able to participate after the Active Dataset update.
Hope that helps.
--