---
title: "Rotate an API key"
method: POST
path: "/v1/api-keys/{api_key_id}:rotate"
tags: ["API Keys"]
---

# Rotate an API key

`POST /v1/api-keys/{api_key_id}:rotate`

## Request

- Base URL: `https://api.naturali.ai`
- URL: `https://api.naturali.ai/v1/api-keys/{api_key_id}:rotate`
- Auth: HTTP bearer

Issues a new secret for the same key record (same id, scope and capabilities) and invalidates the previous secret. The new raw `key` is returned only in this response.
Refused for a connected app, like creation: rotation returns a raw secret for a key the caller need never have held, so it reaches the same place by another door.

## Response `200`

Rotated. The new raw key value is only returned here.

- ApiKeyCreated
  - `id` string, required: Public API key ID (key_ prefix).
  - `name` string, required
  - `key_prefix` string, required: Leading characters of the raw key, for identification.
  - `scope` 'project' | 'account', required: Whether the key is scoped to one project or the whole account.
  - `project_id` string, nullable: The project this key is scoped to; null for account-scoped keys.
  - `capabilities` string[], required: Capabilities granted to this key. Empty means it inherits the creator's.
  - `created_at` string, date-time, required
  - `last_used_at` string, date-time, nullable: When the key was last presented; null if never used.
  - `key` string, required: The raw API key value (only returned once, at creation or rotation). Use as the Bearer token.

## Other responses

- `401`: Missing or invalid credentials.
- `403`: Authenticated, but not permitted to act on this key.
- `404`: The resource does not exist (existence is not leaked).

---

[API](https://skmtc.dev/naturali/apis/naturali-ai-api.md) · [All operations](https://skmtc.dev/naturali/apis/naturali-ai-api/llms.txt) · [OpenAPI document](https://skmtc.dev/naturali/apis/naturali-ai-api/revisions/e4905b78f422?raw)