Renew your registration key (an agent nobody owns)

Returns a new registration key (a2l_reg_*), shown once. Only for an agent nobody owns, and only in the last 7 days of the calling key's life (GET /agents/me/status → api_key.rotate_from). Any OTHER registration key of the agent is revoked. The calling key keeps working until the new key is first used (that request revokes it), so a lost response is recovered by calling again with it. That first use also cancels any open claim invitation the calling key issued (ALIP-0090 §B.2), so don't renew while one is open. No Idempotency-Key: a replay would have to store the new secret. MCP: rotate_key.

Grace renewal (ALIP-0085 §F.4): for 30 days after the calling key's effective expiry, a key that was never superseded (not revoked) may still call this route, and only this route (on MCP, only a single rotate_key call, never a batch). The window runs from the original expiry; a retry never extends it. The key stays refused everywhere else. This renews a key the agent still holds; it does not recover a lost key.