Skip to content
InternetData

Rotate

post/api/v1/iam/apikeys/{id}/rotate

Replaces the secret behind a key, keeping its ID, name and settings. The previous secret stops working immediately. The new secret comes back in the answer, so this needs apikeys.reveal as well as apikeys.manage.

Authorization

BearerAuthbearer token

Authorization: Bearer <key>, with a key from the console. Keys are default-deny: each operation names the scope it needs, and an existing key does not gain an operation until that scope is added to it.

Scopes: apikeys.manage, apikeys.reveal

Path parameters

idrequiredstring (uuid)

The key's ID, as returned by the list endpoint. Never the key itself.

Responses

200application/json

The key, with its new secret.

rcrequiredstring
idrequiredstring (uuid)
namestring
keyrequiredstring

The secret. Returned once, here, and never again.

key_prefixstring
allowed_cidrsarray<string>
allowed_scopesarray<string>
TypeScript type
ts
{
  rc: string;
  id: string;
  name?: string;
  key: string;
  key_prefix?: string;
  allowed_cidrs?: string[];
  allowed_scopes?: string[];
}
401application/json

No credential was presented, or it is not valid.

rcrequiredstring

The outcome. SUCCESS on success; otherwise the reason.

TypeScript type
ts
{
  rc: string;
}
403application/json

The credential does not hold the scope this endpoint requires. The missing scope is deliberately not named.

rcrequiredstring

The outcome. SUCCESS on success; otherwise the reason.

TypeScript type
ts
{
  rc: string;
}
404application/json

No such key in this organization.

rcrequiredstring

The outcome. SUCCESS on success; otherwise the reason.

TypeScript type
ts
{
  rc: string;
}