---
title: "Rotate Api Key"
method: POST
path: "/api-keys/{api_key_id}/rotate"
tags: ["API Keys"]
---

# Rotate Api Key

`POST /api-keys/{api_key_id}/rotate`

## Request

- Base URL: `https://be.graph8.com/api/v1`
- URL: `https://be.graph8.com/api/v1/api-keys/{api_key_id}/rotate`
- Auth: HTTP bearer

Rotate a key, preserving its mode, scopes and agency status.

The old key is deleted and a policy-equivalent replacement is minted; the
new token is returned exactly once. Ownership is enforced by the org-scoped
lookup below (mirroring the delete route) plus `rotate_api_key`'s own
org-scoped read-back (`campaign_builder/services/propelauth.py`).

Guard 4 (mode non-escalation) applies here too — see module docstring point
4. Rotation PRESERVES the target key's mode, so without this a `test`-mode
caller could rotate a `live` key and receive a brand-new `live` token (while
invalidating the working live key). That is the same escalation the create
route coerces away, so refuse it here rather than coerce: a rotation cannot
be silently downgraded to `test` without destroying a working live key.

## Path parameters

- `api_key_id` string, required

## Headers

- `X-Target-Org-Id` string, nullable
- `Authorization` string, nullable

## Request body

- ApiKeyRotateRequest: Request to rotate a key. Mode, scopes and agency status are preserved from the key being rotated — none are settable here. ``ip_allowlist`` is settable on rotation: a rotation is the natural moment to update network restrictions alongside the new credential. When omitted the old key's allowlist is preserved.
  - `name` string, nullable
  - `expires_in_days` integer, nullable
  - `ip_allowlist` string[], nullable: Update the IP allowlist on rotation. Omit to preserve the existing allowlist. Pass [] to remove all restrictions.

## Response `200`

Successful Response

- ApiResponseApiKeyCreateResponse
  - `data` ApiKeyCreateResponse, required: Response after minting a key. ``api_key_token`` is returned exactly once, here, at creation. No other endpoint on this router — or the app's — ever returns it again.
    - `api_key_id` string, required
    - `api_key_token` string, required
    - `name` string, required
    - `mode` string
    - `scopes` string[]
  - `pagination` PaginationMeta
    - `page` integer, required: Current page number (1-indexed)
    - `limit` integer, required: Items per page
    - `total` integer, required: Total number of items
    - `has_next` boolean, required: Whether there are more pages
    - `next_cursor` string, nullable: Opaque cursor for the next page; null when there are no more items. Pass it back as the `cursor` query param to fetch the following page without computing page numbers.
    - `total_available` integer, nullable: Search endpoints only: how many records really match, when known. Can be larger than `total`, which is capped at the 10,000 results that can be paged. For company search this is a distinct-company estimate. Null when unknown; absent outside search.
    - `total_is_lower_bound` boolean, nullable: Search endpoints only: true when more records match than `total` shows (the result set is larger than the 10,000 results that can be paged). Absent outside search.
    - `notes` string[], nullable: Search endpoints only: plain-language notes about the result, e.g. that more records match than can be paged, or that a reversed `between` range was put in order.

## Other responses

- `422`: Validation Error

---

[API](https://skmtc.dev/graph8/apis/graph8-developer-api.md) · [All operations](https://skmtc.dev/graph8/apis/graph8-developer-api/llms.txt) · [OpenAPI document](https://skmtc.dev/graph8/apis/graph8-developer-api/revisions/2e7cfa0ca921?raw)