---
title: "Rotate Publishable Key"
method: POST
path: "/api/v1/serving-identity/keys/{key_id}/rotate"
tags: ["authed"]
---

# Rotate Publishable Key

`POST /api/v1/serving-identity/keys/{key_id}/rotate`

## Request

- Base URL: `https://api.teaflask.com` (the document declares no server; this is the origin it was published from)
- URL: `https://api.teaflask.com/api/v1/serving-identity/keys/{key_id}/rotate`
- Auth: none declared

Retire the key and create its successor in one step: same mode,
same origin allowlist, same agent selection, fresh key material. The
old key's visitor tokens die on their next request, and pages still
embedding it fail to mint until updated — the revoke semantic
rotating a compromised key asks for.

## Path parameters

- `key_id` string, uuid, required

## Response `201`

Successful Response

- CreatedPublishableKeyResponse: The create and rotate answer: the same shape with the key guaranteed present — a freshly built row always carries it.
  - `id` string, uuid, required: The key's id.
  - `key_prefix` string, required: The key's first characters, to recognize it.
  - `key` string, required: The full publishable key, safe in page source: it names the organization and agent, and grants nothing on its own.
  - `mode` 'live' | 'test', required
  - `allowed_origins` string[], required: The only web origins the key answers requests from. Fixed when the key is created.
  - `status` 'active' | 'revoked', required
  - `revoked_at` string, date-time, nullable, required: When the key was revoked; null while it is active.
  - `last_used_at` string, date-time, nullable, required: When a visitor last started a session with the key; null until the assistant is first opened with it.
  - `created_at` string, date-time, required: When the key was created.
  - `agent_definition_id` string, uuid, nullable, required: The agent this key serves: conversations started with it run that agent's published version.

## Other responses

- `401`: Unauthorized
- `403`: Forbidden
- `404`: Not found
- `405`: Method not allowed
- `422`: Validation error
- `500`: Internal server error

---

[API](https://skmtc.dev/teaflask/apis/teaflask-api.md) - [All operations](https://skmtc.dev/teaflask/apis/teaflask-api/llms.txt) - [OpenAPI document](https://skmtc.dev/teaflask/apis/teaflask-api/revisions/d23e9286b847?raw)