---
title: "Rotate an API key secret"
method: POST
path: "/apiKeys/{apiKeyId}/rotate"
tags: ["API keys"]
---

# Rotate an API key secret

`POST /apiKeys/{apiKeyId}/rotate`

## Request

- Base URL: `https://api.cactal.ai/v1`
- URL: `https://api.cactal.ai/v1/apiKeys/{apiKeyId}/rotate`
- Auth: HTTP bearer

Generates a new 32-byte base64url secret for the key and invalidates the old secret immediately; name, expiry, and access are unchanged. The response contains the new plaintext secret exactly once. Revoked or expired keys cannot be rotated (409).

## Path parameters

- `apiKeyId` string, required

## Response `200`

The key metadata and the new `plaintextKey` secret. Store the secret now; it is never shown again.

- object
  - `apiKey` object, required: Metadata and access configuration of the key.
    - `id` string, required: Unique id of the API key.
    - `name` string, required: Human-readable label, 1–200 characters.
    - `organizationId` string, required: Id of the organization that owns the key.
    - `access` union, required: Access configuration of an API key: either one organization-wide role, or one role across an explicit set of websites. The `owner` role can never be granted to an API key.
      - object
        - `kind` 'organization', required: Grants one role across the entire organization.
        - `role` 'admin' | 'full_editor' | 'content_editor', required: Organization-wide role held by the key.
      - object
        - `kind` 'websites', required: Grants one role on an explicit set of websites.
        - `websiteIds` string[], required: Ids of the websites the key can access. All must belong to the organization of the key.
        - `role` 'content_editor' | 'full_editor', required: Role held by the key on each listed website.
    - `expiresAt` string, date-time, nullable, required: When the key stops authenticating. `null` when it never expires.
    - `revokedAt` string, date-time, nullable, required: When the key was revoked. `null` while the key is active.
    - `createdAt` string, date-time, required: When the key was created.
  - `plaintextKey` string, required: The plaintext secret, a 32-byte base64url string. Store it now; it is never shown again, and only a SHA-256 hash is kept.

## Other responses

- `400`: Validation failed. The response `message` names the first invalid field.
- `401`: Missing, invalid, expired, or revoked API key.
- `403`: The authenticated principal lacks the required capability.
- `404`: The resource does not exist or is outside the principal’s access scope.
- `409`: The request conflicts with the current state of the resource.
- `429`: Rate limit exceeded. Retry after the number of seconds in the `Retry-After` header.

---

[API](https://skmtc.dev/cactal/apis/cactal-api.md) · [All operations](https://skmtc.dev/cactal/apis/cactal-api/llms.txt) · [OpenAPI document](https://skmtc.dev/cactal/apis/cactal-api/revisions/9cd0fb5eacdd?raw)