---
title: "Rotate an API key"
method: POST
path: "/keys/{id}/rotate"
tags: ["Credentials"]
---

# Rotate an API key

`POST /keys/{id}/rotate`

## Request

- Base URL: `https://api.primitive.dev/v1`
- URL: `https://api.primitive.dev/v1/keys/{id}/rotate`
- Auth: HTTP bearer

Mint a successor with the same grant and return its secret once. The old key keeps working for overlap_seconds, then stops. The person rotating must cover the key's access (403 grant_forbidden, details.reason target_not_covered), and a key an owner created is rotated by an owner only (403 forbidden, details.reason owner_key_rotation), since rotating hands over the new secret. The Primitive CLI's token is refused, even with a step-up. Needs the organization's credential features to be enabled; while they are not, this answers 404 feature_disabled.

Person only: a dashboard session, or the person's own OAuth token with a step-up token for purpose `keys.create` in the Primitive-Step-Up header. Without one an OAuth token is answered 403 step_up_required, whose details carry the dashboard URL that issues it (or 403 grant_forbidden when the person's role could not do it anyway). The person's role must hold keys:manage. API keys and agent connection keys are refused. An agent acting for the person is refused unless it carries a step-up token the person issued in the dashboard.

## Path parameters

- `id` string, required

## Headers

- `Primitive-Step-Up` string
- `Idempotency-Key` string

## Request body

- CredentialsRotateKeyInput
  - `overlap_seconds` integer

## Response `200`

Success

- object
  - `success` true, required
  - `data` CredentialsRotateKeyResult, required
    - `id` string, required
    - `key` string, required
    - `key_prefix` string, required
    - `expires_at` string, date-time, nullable
    - `previous_key_id` string, required
    - `previous_key_expires_at` string, date-time, required

## Other responses

- `400`: Invalid request parameters
- `401`: Invalid or missing API key
- `403`: Authenticated caller lacks permission for the operation
- `404`: Resource not found
- `409`: The request conflicts with the current state of the resource
- `429`: Rate limit exceeded. The `ratelimit-*` headers describe the limiter that rejected this request, with its own limit and window, not the API budget that successful responses report. A limiter that reports only a wait sends `Retry-After` alone.

---

[API](https://skmtc.dev/primitive/apis/primitive-api.md) - [All operations](https://skmtc.dev/primitive/apis/primitive-api/llms.txt) - [OpenAPI document](https://skmtc.dev/primitive/apis/primitive-api/revisions/bce409c97acb?raw)