---
title: "Issue a fresh secret for an API key"
method: POST
path: "/keys/{id}/rotate"
tags: ["Keys"]
---

# Issue a fresh secret for an API key

`POST /keys/{id}/rotate`

## Request

- Base URL: `https://statable.com/api/v1`
- URL: `https://statable.com/api/v1/keys/{id}/rotate`
- Auth: HTTP bearer
- TypeScript: <https://skmtc.dev/statable/apis/statable-stats-api/docs/keys/:id/rotate/post.ts> (a function with typed inputs; its response is checked against the schema)

Replaces the key's secret in place — same id, name, site scope, scopes and expiry — and invalidates the old token immediately. The new token is returned exactly once. No request body. A key cannot rotate itself (409 `self_modification`), nor a key it could not have created: one with a scope it lacks (403 `scope_escalation`) or, for a single-site key, one that is not locked to the same site (403 `key_not_scoped`).

## Path parameters

- `id` integer, required

## Response `200`

The rotated key, including the one-time raw token.

- CreatedAPIKey: The non-secret view of a key. The raw token is never stored and never appears here — only in the create/rotate responses.
  - `id` integer, required
  - `name` string, required
  - `prefix` string, required: Non-secret fragment of the token, to identify the key in a list.
  - `website_id` integer, nullable, required: The site the key is locked to; null = all of the owner's sites.
  - `scopes` string, required: Comma-separated scope set, in catalog order.
  - `created_at` string, date-time, required
  - `created_ip` string, nullable
  - `last_used_at` string, date-time, nullable
  - `last_used_ip` string, nullable
  - `expires_at` string, date-time, nullable: null = never expires. Only dashboard-created keys can be non-expiring; keys created over the API always carry an expiry.
  - `token` string, required: The raw bearer token. Store it now.

## Other responses

- `401`: Missing/malformed/invalid/revoked bearer token (`unauthorized`), or a key past its expiry (`key_expired`; the message names the expiry time).
- `403`: `insufficient_scope` (the key lacks `keys:manage`), `scope_escalation` (the requested scopes, or the target key's on rotate and revoke, exceed the authenticating key's scopes) or `key_not_scoped` (a single-site key tried to widen its site scope, or to rotate or revoke a key outside it).
- `404`: `api_key_not_found` — unknown, already revoked, or another account's key id (deliberately indistinguishable). Or `write_disabled` when the write surface is off.
- `409`: `self_modification` — a key may not rotate or revoke itself, so an agent cannot destroy the credential it is mid-flow with.
- `429`: Hourly account (default 2000/h) or per-key (default 600/h) limit hit (`rate_limited`). Retry after the `Retry-After` seconds. The X-RateLimit-* headers report the window that tripped (account on an account limit).
- `500`: Unexpected server error (`internal`). Report it with the `request_id` from the body or the X-Request-ID header: it is what lets the exact log entry be found, and without it a 500 can only be matched by guessing at a time window.

---

[API](https://skmtc.dev/statable/apis/statable-stats-api.md) - [All operations](https://skmtc.dev/statable/apis/statable-stats-api/llms.txt) - [OpenAPI document](https://skmtc.dev/statable/apis/statable-stats-api/revisions/352b6d47c186?raw)