Accounts

Rotate an API key (issue replacement and revoke the old one atomically)

Session keys (the ones minted by dashboard login) can't be rotated: they always expire on their own; rotating one returns 409 CONFLICT with details.reason "session_key". Rotate a USER key instead. A key an OAuth connection holds (oauth_grant on the keys list) can't be rotated either: the replacement would not belong to the connection, so the app would stop working. That returns 409 CONFLICT with details.reason "oauth_grant"; revoke the connection and reconnect instead.

Requires api_keys:w.

post/v1/accounts/{id}/api-keys/{keyId}/rotate

Request

  • Base URL: https://api.honkio.ca
  • URL: https://api.honkio.ca/v1/accounts/{id}/api-keys/{keyId}/rotate
  • Auth: one of:
    • HTTP bearer
    • API key in header X-API-Key

Path parameters

idstring required
keyIdstring required

Headers

x-step-up-tokenstring

A token from POST /v1/auth/step-up with the api_keys:elevate scope. Only needed to rotate a key into one holding more than the calling key's own permissions, or when the calling key is a dashboard session key.

Response

The replacement key, shown once. The old key is revoked in the same step; the new one keeps its mode, label, permissions, default-deny setting, lists and email-domain restriction.

keystring required

The full new API key (shown once only).

prefixstring required
mode'live' | 'test' required
revoked_idstring required

The id of the key this replaced.

noticestring required

Changes

No recorded changes to this operation across all 1 revision of this API.