Rotate Organization Api Key

Rotate an API key: mint a replacement under a new id, returning the new token.

The replacement clones the key's name, scopes, claims, and project scoping under a new id with a fresh secret. The old key is retired after overlap_seconds (default 0 = immediately); a positive value keeps the old secret valid for a cutover window. The new token is returned only here, so store it now.

Only a currently-valid key can be rotated. An expired key cannot be rotated (it has no working secret to clone; create a new key instead); a disabled key cannot be rotated either (that would re-enable it under a new secret; enable it first).

The replacement of a personal key expires no later than the calling API key, or the OAuth grant behind the calling access token. So a personal key cannot renew itself past the credential, and the sign-in, that it came from.