HEhedra-labs
Access

Rotate Key

Changed on
post/keys/{key_id}/rotate

Request

  • Base URL
    https://api.hedra.com/v3
  • Auth
    • API key in header Authorization
    • or HTTP bearer

Path parameters

key_idstring required

The key's public identifier.

Request body

grace_period_secondsinteger nullable

Seconds the old secret keeps authenticating after the rotation; omitted means the service default (24h).

Response

Successful Response

key_idstring required

The key's public identifier — unchanged by rotation.

credentialstring required

The new <key_id>:<secret> pair — a valid Bearer credential, shown exactly once, like at create.

kind'personal' | 'service' required

Personal keys die with the member; service keys belong to the workspace.

namestring nullable

Human-readable label for the key.

scopesstring[] nullable

Scopes granted to the key; null means every scope except the opt-in sandboxes:read, sandboxes:write and sandboxes:exec (a legacy key predating scopes).

workspace_idstring nullable

The workspace the key bills and acts in.

expires_atstring date-time nullable

ISO-8601 instant the key stops authenticating; null means it never expires.

previous_secret_expires_atstring date-time nullable

ISO-8601 instant the previous secret stops authenticating — the end of the grace window.

Changes