Keys

Issue a fresh secret for an API key

Replaces the key's secret in place — same id, name, site scope, scopes and expiry — and invalidates the old token immediately. The new token is returned exactly once. No request body. A key cannot rotate itself (409 self_modification), nor a key it could not have created: one with a scope it lacks (403 scope_escalation) or, for a single-site key, one that is not locked to the same site (403 key_not_scoped).

post/keys/{id}/rotate

Request

Base URL
https://statable.com/api/v1
Auth
HTTP bearer
TypeScript
https://skmtc.dev/statable/apis/statable-stats-api/docs/keys/:id/rotate/post.ts
A function with typed inputs. Its response is checked against the schema.

Path parameters

idinteger required

Numeric API key id (from GET /keys).

Response

The rotated key, including the one-time raw token.

idinteger required

namestring required

prefixstring required

Non-secret fragment of the token, to identify the key in a list.

website_idinteger nullable required

The site the key is locked to; null = all of the owner's sites.

scopesstring required

Comma-separated scope set, in catalog order.

created_atstring date-time required

created_ipstring nullable

last_used_atstring date-time nullable

last_used_ipstring nullable

expires_atstring date-time nullable

null = never expires. Only dashboard-created keys can be non-expiring; keys created over the API always carry an expiry.

tokenstring required

The raw bearer token. Store it now.

Example response

{
  "prefix": "stbl_A1b2C3d4",
  "scopes": "read",
  "token": "stbl_Z9y8X7w6…"
}

Changes

No recorded changes to this operation across all 1 revision of this API.