---
title: "Rotate a service account API key"
method: POST
path: "/api/v0/service-accounts/{serviceAccountId}/api-keys/{keyId}/rotate"
tags: ["Service Accounts"]
---

# Rotate a service account API key

`POST /api/v0/service-accounts/{serviceAccountId}/api-keys/{keyId}/rotate`

## Request

- Base URL: `https://api.factory.ai`
- URL: `https://api.factory.ai/api/v0/service-accounts/{serviceAccountId}/api-keys/{keyId}/rotate`
- Auth: HTTP bearer

DESTRUCTIVE: atomically revokes the existing key and issues a replacement that inherits its name, returning the new one-time key value (shown only once). The previous key stops authenticating the instant this call succeeds, so any client still using it will immediately start failing with 401. Update every consumer with the new value before rotating, or set `gracePeriodMinutes` to keep the old key valid for a short overlap window.

## Path parameters

- `serviceAccountId` string, required: Service account ID
- `keyId` string, required: API key ID

## Request body

- RotateServiceAccountApiKeyRequestBody
  - `expiresAt` integer
  - `gracePeriodMinutes` integer: How long (0-10 minutes) the rotated-from key stays valid after rotation. Omit or 0 revokes it immediately. Rejected with a 400 if the key would expire before the grace window ends (the grace period never extends a key lifetime).

## Response `200`

Response for status 200

- RotateServiceAccountApiKey200ResponseBody
  - `apiKey` object, required
    - `id` string, required: API key ID
    - `value` string, required: One-time presentation key value, returned only on creation
    - `fingerprint` string, required: Non-reversible suffix for display
    - `name` string, required: Human-readable name for the key
    - `expiresAt` number: Unix epoch milliseconds when the key expires, if set

## Other responses

- `400`: Response for status 400
- `401`: Response for status 401
- `403`: Response for status 403
- `404`: Response for status 404
- `409`: Response for status 409
- `500`: Response for status 500

---

[API](https://skmtc.dev/factory/apis/factory-public-api.md) - [All operations](https://skmtc.dev/factory/apis/factory-public-api/llms.txt) - [OpenAPI document](https://skmtc.dev/factory/apis/factory-public-api/revisions/061507532814?raw)