---
title: "Rotate a Consent runtime key"
method: POST
path: "/v1/projects/{projectId}/consent/runtime-keys/{keyId}/rotate"
tags: ["Consent"]
---

# Rotate a Consent runtime key

`POST /v1/projects/{projectId}/consent/runtime-keys/{keyId}/rotate`

## Request

- Base URL: `https://api.inth.com`
- URL: `https://api.inth.com/v1/projects/{projectId}/consent/runtime-keys/{keyId}/rotate`
- Auth: HTTP bearer

Directly verifies tenant and project ownership, then atomically rerolls the key with its existing configuration. overlapSeconds is required, from 0 to 86400. Zero expires the old secret immediately; positive values allow deployment overlap. The replacement secret is returned once. Disabled or expired keys cannot be rotated. Do not retry blindly after an uncertain response. A current Consent runtime is required. Requires consent.keys.write, projects.read and projects.write, with an admin or owner role. Subject to rollout-agent-access-writes and allow-public-agent-writes. Organization API keys cannot call this operation.

## Path parameters

- `projectId` string, required
- `keyId` string, required

## Request body

- ProjectConsentRuntimeKeyRotate
  - `overlapSeconds` integer, required

## Response `200`

Success

- object
  - `success` unknown, required
  - `data` ProjectConsentRuntimeKeyRotation, required
    - `id` string, required
    - `name` string, required
    - `createdAt` string, required
    - `instanceId` string, nullable, required
    - `start` string, required
    - `key` string, required
    - `secretAvailableOnce` true, required
    - `rotatedFromId` string, required
    - `overlapSeconds` integer, required

## Other responses

- `400`: The request payload or parameters are invalid.
- `401`: Authentication is missing, invalid, or expired.
- `403`: The credential is valid but may not perform the operation. `INSUFFICIENT_SCOPE`: the credential was never granted the capability the operation needs. `details.requiredScope` names it, and the `WWW-Authenticate` header carries `Bearer error="insufficient_scope"`. An OAuth client fixes this by requesting the scope; an organization API key cannot gain it. `FORBIDDEN`: the capability is present but the membership behind the credential lacks the role, or the resource belongs to another organization.
- `404`: The requested resource was not found.
- `409`: The request conflicts with the current resource state.
- `503`: The capability is temporarily paused by an operator. Retry later.

## Changes

- **2026-10-31** `a3f4100e14c9`: 1 info
  - endpoint added

[Operation history](https://skmtc.dev/inth/apis/inth-api/changes/v1/projects/:projectId/consent/runtime-keys/:keyId/rotate/post.md)

---

[API](https://skmtc.dev/inth/apis/inth-api.md) - [All operations](https://skmtc.dev/inth/apis/inth-api/llms.txt) - [OpenAPI document](https://skmtc.dev/inth/apis/inth-api/revisions/8741280c3463?raw)