---
title: "Rotate an API key"
method: POST
path: "/api-keys/{apiKeyId}/rotate"
tags: ["API Keys"]
---

# Rotate an API key

`POST /api-keys/{apiKeyId}/rotate`

Atomically replaces an API key secret while preserving its stable id; omitted label and scope fields keep their current values. Requires api_keys:write, a live admin/owner membership, an Idempotency-Key, and a different administrator key than the target. The old secret stops authenticating immediately. The encrypted replacement response is replayable for 24 hours through the same administrator key.

## Path parameters

- `apiKeyId` string, required — Stable API key identifier.

## Headers

- `Idempotency-Key` string, required — Idempotency key.

## Request body

- ApiKeyRotateBody — Atomically replaces an API key secret. Omitted label and scope fields retain their current values.
  - `name` string, nullable — Replacement operator-facing key label.
  - `scopes` string[] — Exact replacement non-administrative scopes.

## Response `200`

Rotated API key.

- ApiKeySecretResponse — API key response that reveals the new secret exactly once.
  - `data` object, required — New credential data.
    - `key` ApiKey, required — Reveal-safe API key metadata. The secret is only returned by issue and rotate responses.
      - `id` string, required — Stable API key identifier.
      - `key_prefix` string, required — Non-secret prefix for operator recognition.
      - `name` string, nullable, required — Optional operator-facing key label.
      - `scopes` string[], required — Exact scopes granted to the key.
      - `status` 'active' | 'disabled' | 'revoked', required — Credential lifecycle status.
      - `subject` ApiKeySubject, required — Workspace identity the credential acts as.
        - `display_name` string, nullable, required — Current subject display name.
        - `principal_type` 'agent' | 'user', required — Subject principal type.
        - `workspace_membership_id` string, required — Subject workspace membership identifier.
    - `secret` string, required — New API key secret. Store it immediately; it cannot be read later.

## Other responses

- `400` — Bad request.
- `401` — Missing or invalid API key.
- `403` — Forbidden.
- `404` — Not found.
- `409` — Conflict.
- `429` — Rate limit or quota exceeded.
- `500` — Internal server error.

---

[API](https://skmtc.net/ando/apis/ando-public-api.md) · [All operations](https://skmtc.net/ando/apis/ando-public-api/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/ando/ando-public-api/revisions/0a94056fba48/schema)