---
title: "Rotate an API key"
method: POST
path: "/org/api_keys/{id}/rotate"
tags: ["API Keys"]
---

# Rotate an API key

`POST /org/api_keys/{id}/rotate`

Rotate an API key. Issues a new key that copies the name and project of the rotated key, and schedules the rotated key to expire after a grace period so in-flight callers can swap over. The new plaintext key is returned once.

## Path parameters

- `id` string, required

## Request body

- RotateApiKeyRequest
  - `days_to_expire` integer, nullable — Lifetime in days for the new key, up to 3650. Omit to reuse the rotated key's original lifetime, or never-expires if it had none.
  - `expire_in_days` integer, nullable — Grace period in days before the rotated key expires. Use 0 to expire it immediately. Omit for the default grace period of 7 days.

## Response `201`

New API key created from the rotation

- CreatedApiKey — API key returned immediately after creation. Includes the plaintext key once.
  - `id` string, required — Unique API key identifier
  - `name` string, required — Label for the API key. API keys are not addressable by name; use the ID or key identifier for stable references.
  - `created_at` string, date-time, required — When the API key was created
  - `created_by` ApiKeyCreator, required
    - `id` string, required — Kernel user ID of the creator.
    - `email` string, email, required — Email address of the creator.
    - `name` string, nullable, required — Display name of the creator, if available.
  - `expires_at` string, date-time, nullable, required — When the API key expires
  - `deleted_at` string, date-time, nullable, required — When the API key was deleted (soft-deleted). Null for keys that have not been deleted.
  - `project_id` string, nullable, required — Project identifier for project-scoped API keys. Null means org-wide.
  - `project_name` string, nullable, required — Project name for project-scoped API keys. Null means the key is org-wide or the project name is unavailable.
  - `masked_key` string, required — Masked version of the API key
  - `key` string, required — Plaintext API key. Only returned once when the key is created.

## Other responses

- `400` — Bad Request – invalid input
- `401` — Unauthorized – missing or invalid authorization token
- `404` — Resource not found
- `500` — Internal Server Error

---

[API](https://skmtc.net/kernel/apis/kernel-api.md) · [All operations](https://skmtc.net/kernel/apis/kernel-api/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/kernel/kernel-api/versions/9e8ce9fcf5e1/schema)