---
title: "Rotate Api Key"
method: POST
path: "/api/v1/api-keys/{key_id}/rotate"
tags: ["api-keys"]
---

# Rotate Api Key

`POST /api/v1/api-keys/{key_id}/rotate`

## Request

- Base URL: `https://api.badgeia.com`
- URL: `https://api.badgeia.com/api/v1/api-keys/{key_id}/rotate`
- Auth: none declared

Rotate a key: mint a new one with the same name + scopes + rate limits,
soft-revoke the old one. Returns the NEW full key (shown once).

Use this when a key may have been leaked or as part of regular hygiene.
The new key takes effect immediately; the old key is dead immediately
(no overlap window — clients should swap atomically).

## Path parameters

- `key_id` string, uuid, required

## Response `201`

Successful Response

- ApiKeyRotated: Returned by POST /api-keys/{id}/rotate. `id` is the OLD key's id, kept for the client to map UI rows. The new key has its own id, prefix, key_hash; the old key is soft-revoked. Includes the new full key — shown once.
  - `id` string, uuid, required
  - `name` string, required
  - `key_prefix` string, required
  - `scopes` string, required
  - `rate_limit_per_minute` integer, required
  - `rate_limit_per_day` integer, required
  - `total_requests` integer, required
  - `last_used_at` string, date-time, nullable, required
  - `is_active` boolean, required
  - `expires_at` string, date-time, nullable, required
  - `created_at` string, date-time, required
  - `full_key` string, required
  - `rotated_from_id` string, uuid, required
  - `new_id` string, uuid, required

## Other responses

- `422`: Validation Error

---

[API](https://skmtc.dev/badgeia/apis/badge.md) · [All operations](https://skmtc.dev/badgeia/apis/badge/llms.txt) · [OpenAPI document](https://skmtc.dev/badgeia/apis/badge/revisions/7e7f7fee8b77?raw)