Rotate an API key

Creates a NEW API key inheriting the source key's scope, permissions and IP allowlist. The source key stays active for graceHours (default 24h) to allow downstream services to migrate. The new plaintext is returned ONCE. Repeating the request with the same Idempotency-Key answers 409 API_KEY_ALREADY_ISSUED with the successor id in instance.

Authorization

bearer

AuthorizationBearer <token>

In: header

Path Parameters

id*string

Header Parameters

Idempotency-Key*string

Unique per issuing request, 1-128 characters. A replay never issues a second key and never reveals the secret again.

Request Body

application/json

TypeScript Definitions

Use the request body type in TypeScript.

graceHours?integer

Number of hours the source key stays active after rotation. 0 cuts it over immediately; default 24h.

Default24

Range0 <= value <= 720

Response Body

`application/json`

curl -X POST "https://<api-host>/v1/api-keys/string/rotate" \  -H "Idempotency-Key: string" \  -H "Content-Type: application/json" \  -d '{}'

{
  "data": {
    "id": "497f6eca-6276-4993-bfeb-53cbbbba6f08",
    "tenantId": "f97df110-f4de-492e-8849-4a6af68026b0",
    "livemode": true,
    "owner": {
      "type": "merchant",
      "merchantId": "c3073b9d-edd0-49f2-a28d-b7ded8ff9a8b",
      "tenantId": "f97df110-f4de-492e-8849-4a6af68026b0"
    },
    "environment": "test",
    "keyType": "public",
    "inboundFormat": "miracle_native",
    "publicKey": "string",
    "name": "string",
    "status": "active",
    "permissions": [
      "string"
    ],
    "ipAllowlist": [
      "string"
    ],
    "expiresAt": "string",
    "createdAt": "string",
    "updatedAt": "string",
    "deletedAt": null,
    "revokedAt": "string",
    "rotatedFromKeyId": "398ea6c9-3802-4188-a0cb-054a865227fd",
    "createdBy": "25a02396-1048-48f9-bf93-102d2fb7895e",
    "createdByType": "user",
    "secretKey": "string"
  }
}

Empty