v1

latestOpenAPI 3.1.0BUSL-1.12026-07-1756132288.0 KB

Rotate the secret on one of the caller's own keys. The id stays stable (preserving the principal binding and attenuating grants); the previous secret stops validating immediately. ttlSeconds is reset-or-inherit, matching the management rotate path.

post/api/v1/{context_id}/keys/{key_name}/rotate

Path parameters

context_idstring required

Spectron context id

key_namestring required

Key name

Query parameters

ttlSecondsinteger nullable

Seconds until the minted/rotated key expires. Omitted on create = "never expires" (subject to the Context's max_token_ttl_seconds cap). Omitted on rotate = inherit the key's current expiry.

Response

Plaintext rotated key returned once

idstring required

The key's stable record-id key (survives rotation).

keystring required

The full bearer key (sp-{id}-{secret}). Send as Authorization: Bearer ….

validUntilstring date-time nullable

Mint-time expiry. Absent ⇒ no expiry.