latestOpenAPI 3.0.32026-08-2142130334.7 KB

0a94056fba48

API Keys

Rotate an API key

Atomically replaces an API key secret while preserving its stable id; omitted label and scope fields keep their current values. Requires api_keys:write, a live admin/owner membership, an Idempotency-Key, and a different administrator key than the target. The old secret stops authenticating immediately. The encrypted replacement response is replayable for 24 hours through the same administrator key.

post/api-keys/{apiKeyId}/rotate

Path parameters

apiKeyIdstring required

Stable API key identifier.

Headers

Idempotency-Keystring required

Idempotency key.

Required key for safe retries. Reusing it with different parameters returns 409 idempotency_conflict. The encrypted secret response can be replayed for 24 hours.

Request body

namestring nullable

Replacement operator-facing key label.

scopesstring[]

Exact replacement non-administrative scopes.

Response

Rotated API key.

Example response

{
  "data": {
    "key": {
      "id": "01jzn7e61x3a7v9h2r7t2m3q4p",
      "subject": {
        "workspace_membership_id": "01jzn7e61x3a7v9h2r7t2m3q4p"
      }
    }
  }
}