API Keys

Rotate Api Key

Rotate a key, preserving its mode, scopes and agency status.

The old key is deleted and a policy-equivalent replacement is minted; the new token is returned exactly once. Ownership is enforced by the org-scoped lookup below (mirroring the delete route) plus rotate_api_key's own org-scoped read-back (campaign_builder/services/propelauth.py).

Guard 4 (mode non-escalation) applies here too — see module docstring point 4. Rotation PRESERVES the target key's mode, so without this a test-mode caller could rotate a live key and receive a brand-new live token (while invalidating the working live key). That is the same escalation the create route coerces away, so refuse it here rather than coerce: a rotation cannot be silently downgraded to test without destroying a working live key.

post/api-keys/{api_key_id}/rotate

Request

  • Base URL: https://be.graph8.com/api/v1
  • URL: https://be.graph8.com/api/v1/api-keys/{api_key_id}/rotate
  • Auth: HTTP bearer

Path parameters

api_key_idstring required

Headers

X-Target-Org-Idstring nullable
Authorizationstring nullable

Request body

namestring nullable
expires_in_daysinteger nullable
ip_allowliststring[] nullable

Update the IP allowlist on rotation. Omit to preserve the existing allowlist. Pass [] to remove all restrictions.

Response

Successful Response

Changes

No recorded changes to this operation across all 2 revisions of this API.