---
title: "Rotate Organization Api Key"
method: POST
path: "/v1/api-keys/{api_key_id}/rotate/"
tags: ["API Keys"]
---

# Rotate Organization Api Key

`POST /v1/api-keys/{api_key_id}/rotate/`

## Request

- Base URL: `https://logfire-api.pydantic.dev/api`
- URL: `https://logfire-api.pydantic.dev/api/v1/api-keys/{api_key_id}/rotate/`
- Auth: OAuth 2
  - Authorization code: `api/oauth/authorize`
  - Token URL: `/api/oauth/token` scopes: `organization:write_api_key`, `organization:create_api_key`
- TypeScript: <https://skmtc.dev/pydantic/apis/pydantic-logfire-api/docs/v1/api-keys/:api_key_id/rotate/post.ts> (a function with typed inputs; its response is checked against the schema)

Rotate an API key: mint a replacement under a new id, returning the new token.

The replacement clones the key's name, scopes, claims, and project scoping under a
new id with a fresh secret. The old key is retired after `overlap_seconds`
(default 0 = immediately); a positive value keeps the old secret valid for a
cutover window. The new token is returned only here, so store it now.

Only a currently-valid key can be rotated. An expired key cannot be rotated (it has
no working secret to clone; create a new key instead); a disabled key cannot be
rotated either (that would re-enable it under a new secret; enable it first).

The replacement of a personal key expires no later than the calling API key, or the OAuth
grant behind the calling access token. So a personal key cannot renew itself past the
credential, and the sign-in, that it came from.

## Path parameters

- `api_key_id` string, uuid, required

## Request body

- APIKeyRotateInput: Optional rotation settings.
  - `overlap_seconds` integer

## Response `200`

Successful Response

- APIKeyRotateOutput: The replacement key's id and its new plaintext token (returned only once).
  - `id` string, uuid, required
  - `token` string, required
  - `expires_at` string, date-time, nullable, required

## Other responses

- `400`: Cannot rotate an expired or disabled API key
- `403`: The rotated key's scopes or project scoping exceed the caller's own grant, or its owner lacks the permissions those scopes require on the project it names
- `404`: API key not found
- `409`: The key's frontend application already has as many live tokens as it may have
- `422`: Validation Error
- `429`: Rate limit exceeded

---

[API](https://skmtc.dev/pydantic/apis/pydantic-logfire-api.md) - [All operations](https://skmtc.dev/pydantic/apis/pydantic-logfire-api/llms.txt) - [OpenAPI document](https://skmtc.dev/pydantic/apis/pydantic-logfire-api/revisions/7996e45256f4?raw)