---
title: "Rotate API key"
method: POST
path: "/api/v1/projects/{projectId}/api-keys/{apiKeyId}/rotate"
tags: ["API Keys"]
---

# Rotate API key

`POST /api/v1/projects/{projectId}/api-keys/{apiKeyId}/rotate`

## Request

- Base URL: `http://localhost:8080`
- URL: `http://localhost:8080/api/v1/projects/{projectId}/api-keys/{apiKeyId}/rotate`
- Auth: one of:
  - HTTP bearer
  - API key in header `X-API-Key`

Issues a replacement key and puts the old one into a grace window, during which both authenticate. The replacement is shown only once. Default window is 24 hours; pass gracePeriodHours=0 to cut the old key off immediately after a suspected leak.

## Path parameters

- `projectId` string, uuid, required
- `apiKeyId` string, uuid, required

## Request body

- ApiKeyRotateRequest
  - `gracePeriodHours` integer
  - `expiresAt` string, date-time

## Response `201`

Replacement key created; the old key is retiring

---

[API](https://skmtc.dev/railhook/apis/railhook-api.md) · [All operations](https://skmtc.dev/railhook/apis/railhook-api/llms.txt) · [OpenAPI document](https://skmtc.dev/railhook/apis/railhook-api/revisions/4e2c76dfc33d?raw)