Agent-driven key rotation: mints a replacement key bound to the SAME account and revokes key_id in one call -- an autonomous agent rotates its own credential without an operator or a human seat in the loop, so usage keeps billing to the account. Scoped to the caller's own customer; key_id need not be the presented key. 404 for an id that doesn't exist, belongs to another tenant, or is already revoked -- indistinguishable, same as delete_key.

scopes, omitted, keeps key_id's own scopes -- rotation replaces a credential, it never widens a narrowed one. Requested or kept, they must be a subset of the PRESENTING key's scopes (key_id need not be the presenting key), else 403 naming the excess.

Requires the account scope.