---
title: "Rotate one API credential"
method: POST
path: "/api/v1/user/api-credentials/{id}/rotate"
tags: ["User", "API Credentials"]
---

# Rotate one API credential

`POST /api/v1/user/api-credentials/{id}/rotate`

Atomically revokes the source and stores the encrypted one-time replacement response with the same transaction. An identical Idempotency-Key retry within 24 hours returns the same token without rotating again.

## Path parameters

- `id` integer, required

## Headers

- `X-CSRF-Token` string, required
- `Idempotency-Key` string, required

## Request body

- ApiCredentialRotateRequest
  - `name` string
  - `scopes` string[]
  - `expires_at` string, date-time, nullable — Omitted preserves the current expiry; null resets to the standard 90-day expiry; maximum 366 days.

## Response `200`

Rotated, or the exact replacement token replayed for the same key and payload

- ApiCredentialOneTimeResponse
  - `ok` true, required
  - `credential` ApiCredential, required
    - `id` integer, required
    - `name` string, required
    - `prefix` string, required — Non-secret identification prefix.
    - `last4` string, required
    - `hint` string, required
    - `scopes` string[], required
    - `status` 'active' | 'expired' | 'revoked', required
    - `created_at` string, date-time, required
    - `expires_at` string, date-time, nullable
    - `revoked_at` string, date-time, nullable
    - `last_used_at` string, date-time, nullable
    - `rotated_from_id` integer, nullable
    - `legacy_migrated` boolean
  - `token` string, required — Visible only in the original create/rotate response and identical Idempotency-Key replays during the 24-hour recovery window; never recoverable through list/get.
  - `token_visible_once` true, required
  - `replaced_credential_id` integer
  - `idempotency_replayed` boolean, required
  - `idempotency_expires_at` integer, required — Unix timestamp for the encrypted replay window.

## Other responses

- `400` — Invalid request
- `401` — Authentication required (no active session)
- `403` — Invalid CSRF token
- `404` — Resource not found
- `409` — Idempotency-Key payload conflict or expired replay window
- `429` — Rate limit exceeded
- `503` — Credential pepper, idempotency encryption keyring/schema, or account service unavailable

---

[API](https://skmtc.net/openmercantil/apis/openmercantil-public-api.md) · [All operations](https://skmtc.net/openmercantil/apis/openmercantil-public-api/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/openmercantil/openmercantil-public-api/versions/996f96a11758/schema)