---
title: "Adopt Api Key"
method: POST
path: "/api/api-keys/adopt"
tags: ["API Keys"]
---

# Adopt Api Key

`POST /api/api-keys/adopt`

## Request

- Base URL: `https://zsign.io` (the document declares no server; this is the origin it was published from)
- URL: `https://zsign.io/api/api-keys/adopt`
- Auth: HTTP bearer

Re-activate a revoked org API key -- iff the caller presents the
secret itself.

Account linking (get_current_user's email-match branch) revokes every
credential minted before a verified owner bound to the account,
because nothing about a pre-link row can prove the key holder and the
inbox owner are the same human. This endpoint is the explicit
proof-of-control recovery for the legitimate holder: only someone who
actually has the raw secret can present it, and the compare is scoped
to revoked keys of the caller's own org, so it can never reach another
account's keys.

An expired key stays dead -- adopt restores the link-time sweep, it
does not resurrect keys that aged out.

## Request body

- AdoptAPIKeyRequest
  - `api_key` string, required: Full secret of the revoked key to re-activate

## Response `200`

Successful Response

- APIKeyResponse
  - `id` string, uuid, required
  - `name` string, required
  - `key_prefix` string, required
  - `last_used_at` string, date-time, nullable, required
  - `expires_at` string, date-time, nullable, required
  - `created_at` string, date-time, required
  - `creator_email` string, nullable

## Other responses

- `422`: Validation Error

---

[API](https://skmtc.dev/zsign/apis/zsign-api.md) · [All operations](https://skmtc.dev/zsign/apis/zsign-api/llms.txt) · [OpenAPI document](https://skmtc.dev/zsign/apis/zsign-api/revisions/a674ac4137ba?raw)