---
title: "Rotate My Key"
method: POST
path: "/v1/me/keys/{key_id}/rotate"
tags: ["me"]
---

# Rotate My Key

`POST /v1/me/keys/{key_id}/rotate`

## Request

- Base URL: `https://api.ctindex.io`
- URL: `https://api.ctindex.io/v1/me/keys/{key_id}/rotate`
- Auth: none declared

Rotate a key. Optional body ``{"grace_period_hours": N}`` keeps the
old key working for N hours (max 168) before it expires — default 0
revokes it immediately (task #618).

## Path parameters

- `key_id` string, uuid, required

## Cookies

- `ctix_session` string, nullable

## Request body

- ApiKeyRotateRequest: Optional body for the rotate endpoints. ``grace_period_hours = 0`` (the default, and the behaviour when no body is sent at all) revokes the old key immediately — today's contract. A positive value keeps the old key working for that many hours so integrations can swap credentials without a hard cut; after the window the old key starts returning 403 ``expired_api_key``.
  - `grace_period_hours` integer: Hours the OLD key keeps working after rotation. 0 (default) revokes it immediately; max 168 (7 days).

## Response `201`

Successful Response

- ApiKeyRotateResponse: Rotate response — the new key plus the old key's fate.
  - `id` string, uuid, required
  - `key` string, required
  - `label` string, nullable
  - `tier` string, required
  - `commercial_use_allowed` boolean
  - `created_at` string, date-time, nullable
  - `example_call` string, nullable: Copy-paste curl against a known-indexed domain (GH #706). Host is taken from EXAMPLE_CALL_DOMAIN (allow-listed); substitute $CERTINDEX_API_KEY.
  - `old_key_id` string, uuid, nullable
  - `old_key_revoked` boolean
  - `old_key_expires_at` string, date-time, nullable

## Other responses

- `422`: Validation Error

---

[API](https://skmtc.dev/ctindex/apis/certindex-api.md) · [All operations](https://skmtc.dev/ctindex/apis/certindex-api/llms.txt) · [OpenAPI document](https://skmtc.dev/ctindex/apis/certindex-api/revisions/d5bc0ec85bc9?raw)