---
title: "Rotate API key"
method: POST
path: "/api/api-keys/{sid}/rotate"
tags: ["api_keys"]
---

# Rotate API key

`POST /api/api-keys/{sid}/rotate`

## Request

- Base URL: `https://beta.getsales.io/id/v1`
- URL: `https://beta.getsales.io/id/v1/api/api-keys/{sid}/rotate`
- Auth: HTTP bearer and API key in header `Team-SID`

Swap the key's secret IN PLACE and return the new plaintext in result.plaintext_token EXACTLY ONCE: hand it to the user, never log it, unrecoverable. Sid, name, permissions and expiry are unchanged. The previous secret stays valid until result.previous_token_expires_at (now plus grace_seconds, 24 hours by default; 0 = immediate cutover), so a config can be updated without downtime. Use when a secret leaks or before an offboarding. NOT idempotent: every call mints a brand-new secret. A revoked or expired key answers 409.

Contract:
- MCP tool `rotate_api_key`, registry package `mcp.id/api_keys`, mount `id.access`.
- Operation `action`, response envelope `action`.
- Flags: dangerous: the MCP layer gates it behind a preview/commit token, and the effect cannot be undone through this API.

## Path parameters

- `sid` string, required: API key sid (id_ak_...).

## Request body

- RotateApiKeyRequest: Request body of `rotate_api_key`.
  - `grace_seconds` integer: 0..604800 (seven days); omit = 24 hours; 0 = the old secret dies at once.

## Response `200`

`action` success envelope.

- RotateApiKeyResponse
  - `success` true, required
  - `operation` 'action', required
  - `action` string, required: kebab-case verb; matches the route segment.
  - `item` object, nullable, required
    - `sid` string, required: API key sid (id_ak_...).
    - `team_sid` string, required: The workspace the key acts as (ts_tm_...).
    - `name` string, required: Human-readable name, unique among the team's live keys.
    - `token_prefix` string, required: The first characters of the token (gs_live_...), for display.
    - `token_last4` string, required: The last four characters of the token, for display.
    - `permissions` string[], required: What the key may do: the explicit token list.
    - `account_sids` string[], nullable, required: The key's sender slice (ln_ac_...), clamped to its issuer's; null = every account of the issuer's own slice.
    - `status` 'active' | 'revoked' | 'expired', required: active = verifies; revoked | expired = refused.
    - `expires_at` string, nullable, required: ISO 8601 UTC; null = perpetual. Default at creation: three years.
    - `last_used_at` string, nullable, required: ISO 8601 UTC of the last verified call; null = never used.
    - `created_by` object, required: The issuer: a person, or a parent key on delegation.
      - `actor_type` 'user' | 'support' | 'api_key' | 'system' | 'agent', required
      - `actor_sid` string, nullable, required
      - `team_sid` string, required
      - `actor_name` string, nullable: The OAuth client that acted ("Claude", "n8n"); null for a user, an API key or a system job.
      - `oauth_client_sid` string, nullable: The acting OAuth client (id_oc_*); null off the OAuth path.
      - `reason` string, nullable: Why a system actor wrote the row (snapshot_capture_job, ...); null otherwise.
      - `permissions` object, required: Internal audit context: the grant set the actor held at write time. Not a contract.
      - `cluster_id` integer, nullable: Internal audit context: the cluster that served the write.
      - `trace_id` string, nullable: Internal audit context: the trace id of the request that wrote the row.
    - `created_at` string, required: ISO 8601 UTC.
    - `updated_at` string, required: ISO 8601 UTC.
    - `deleted_at` string, nullable, required: ISO 8601 UTC; set with status revoked.
  - `result` object, required
    - `plaintext_token` string, required: The new secret, shown once.
    - `previous_token_expires_at` string, nullable, required: ISO 8601 UTC until which the old secret still verifies; null when it died at once.
  - `meta` object, required
    - `trace_id` string, required: UUID v7; same 128-bit value as the X-Trace-Id header.
    - `span_id` string, required: 16 hex chars, root span of this request.
    - `timestamp` string, required: ISO 8601 UTC (Y-m-dTH:i:sZ), response time.
    - `duration_ms` integer, required: Server-side wall clock.
    - `team_sid` string, nullable: The team this call ran in (the token team, or the team_sid override). Null when unauthenticated; absent from pre-2026-08-20 backends.
    - `actor_type` string, nullable: user | agent | api_key | system. Null when unauthenticated; absent from pre-2026-08-20 backends.

## Other responses

- `4XX`: MCP error envelope. `error.code` is one of validation_failed, nothing_to_update, not_found, relation_not_found, invalid_transition, limit_exceeded, payment_required, duplicate_rejected, conflict, delete_blocked, unauthorized, forbidden, rate_limited, not_implemented.
- `5XX`: MCP error envelope with `error.code` internal_error or service_unavailable.

---

[API](https://skmtc.dev/getsales/apis/getsales-public-contract-gs-service-id.md) - [All operations](https://skmtc.dev/getsales/apis/getsales-public-contract-gs-service-id/llms.txt) - [OpenAPI document](https://skmtc.dev/getsales/apis/getsales-public-contract-gs-service-id/revisions/95e48541fe85?raw)