Skip to main content
POST
Rotate an API key

Authorizations

Authorization
string
header
required

An API key (otsk_ + 64 hex) or a console session token.

Path Parameters

key_id
string
required

The key's id: key_ followed by 32 hex characters. Never the secret.

Response

The key, with its new secret.

A key with its secret. Only create and rotate return this.

id
string
required
name
string
required
principal
object
required

Who a key acts as: a user, or a service account owned by the organization.

scopes
enum<string>[]
required

A permission a key or session holds.

Available options:
runs_read,
runs_write,
keys_read,
keys_write,
members_read,
members_write,
billing_read,
billing_write,
usage_read
state
enum<string>
required

A revoked key is kept, never deleted.

Available options:
active,
revoked
secret_prefix
string
required

The first 13 characters of the secret (otsk_ plus 8), for display.

created_by
string
required
created_at
string
required
secret
string
required

The plaintext secret. Shown once. The service stores only its SHA-256 and cannot return this value again; a lost secret is rotated, not recovered.

last_used_at
string | null
revoked_at
string | null