---
title: "Rotate a grant key (owner-only)"
method: POST
path: "/projects/v1/{project_id}/grant-keys/{key_id}/rotate"
tags: ["Org"]
---

# Rotate a grant key (owner-only)

`POST /projects/v1/{project_id}/grant-keys/{key_id}/rotate`

## Request

- Base URL: `https://api.run402.com`
- URL: `https://api.run402.com/projects/v1/{project_id}/grant-keys/{key_id}/rotate`
- Auth: API key in header `SIGN-IN-WITH-X`

Owner-only. Revokes this key and mints a fresh one against the same grant with the same kind/scope/cap/expiry. The new `key.token` (run402_agent_key) is returned ONCE.

## Path parameters

- `project_id` string, required
- `key_id` string, uuid, required

## Headers

- `SIGN-IN-WITH-X` string, required

## Response `201`

Grant key rotated

- object
  - `status` 'rotated'
  - `replaced_key_id` string, uuid
  - `grant_id` string, uuid
  - `key` MintedGrantKey: The minted key. `token` is the run402_agent_key bearer, returned ONCE; null for kinds that carry no bearer.
    - `key_id` string, uuid
    - `kind` string
    - `token` string, nullable: run402_agent_key bearer — returned once.
    - `expires_at` string, date-time, nullable

## Other responses

- `403`: Owner role required (FORBIDDEN)
- `404`: No active grant key with that id on this project (GRANT_KEY_NOT_FOUND)

---

[API](https://skmtc.dev/run402/apis/run402-api.md) · [All operations](https://skmtc.dev/run402/apis/run402-api/llms.txt) · [OpenAPI document](https://skmtc.dev/run402/apis/run402-api/revisions/893607557f50?raw)