---
title: "Rotate an API key (issue replacement and revoke the old one atomically)"
method: POST
path: "/v1/accounts/{id}/api-keys/{keyId}/rotate"
tags: ["Accounts"]
---

# Rotate an API key (issue replacement and revoke the old one atomically)

`POST /v1/accounts/{id}/api-keys/{keyId}/rotate`

## Request

- Base URL: `https://api.honkio.ca`
- URL: `https://api.honkio.ca/v1/accounts/{id}/api-keys/{keyId}/rotate`
- Auth: one of:
  - HTTP bearer
  - API key in header `X-API-Key`

Session keys (the ones minted by dashboard login) can't be rotated: they always expire on their own; rotating one returns 409 CONFLICT with details.reason "session_key". Rotate a USER key instead. A key an OAuth connection holds (oauth_grant on the keys list) can't be rotated either: the replacement would not belong to the connection, so the app would stop working. That returns 409 CONFLICT with details.reason "oauth_grant"; revoke the connection and reconnect instead.

Requires `api_keys:w`.

## Path parameters

- `id` string, required
- `keyId` string, required

## Headers

- `x-step-up-token` string

## Response `201`

The replacement key, shown once. The old key is revoked in the same step; the new one keeps its mode, label, permissions, default-deny setting, lists and email-domain restriction.

- object: The replacement key, shown once. The old key is revoked in the same step; the new one keeps its mode, label, permissions, default-deny setting, lists and email-domain restriction.
  - `key` string, required: The full new API key (shown once only).
  - `prefix` string, required
  - `mode` 'live' | 'test', required
  - `revoked_id` string, required: The id of the key this replaced.
  - `notice` string, required

## Other responses

- `401`: Missing, invalid, revoked or expired API key.
- `402`: The account has no balance, or a LIVE key was used before the first top-up.
- `403`: FORBIDDEN (not your account), LIVE_KEY_REQUIRED (a test key rotating a live key), KEY_FENCED (a key with an allow/deny fence rotating any key but itself), or PERMISSION_ESCALATION (the target holds more than the calling key, or the caller is a dashboard session key, without an api_keys:elevate step-up).
- `404`: NOT_FOUND: no such resource on this account.
- `409`: CONFLICT: the key is already revoked, is being rotated by another request, is a dashboard session key (details.reason is session_key), or is held by an OAuth connection (details.reason is oauth_grant).
- `429`: Rate limit reached: 100 requests per second per account, or a route-specific limit (Retry-After set where one applies).
- `500`: Unexpected server error.

---

[API](https://skmtc.dev/honkio/apis/honkio-api.md) · [All operations](https://skmtc.dev/honkio/apis/honkio-api/llms.txt) · [OpenAPI document](https://skmtc.dev/honkio/apis/honkio-api/revisions/ce4ed3fe9691?raw)