Rotate an API key
Mints a successor with the same name, scopes and lifetime, and ends the old key after overlapHours (default 24, at most 168; 0 ends it now). The old key's new expiry is stored on it and returned. Only the key's creator may rotate it; API keys cannot call this operation. A sandbox's own Claims key (rh_sb_) is managed by RemoteHost and answers 409 with code: "sandbox_key_managed". A workspace-pinned key's successor keeps the pin, and its scopes are checked again against what its principal holds in that workspace (403 scope_exceeds_maker otherwise).
Authorization
bearerAuth A RemoteHost API key (rh_sk_...) or a user session token.
In: header
Path Parameters
Request Body
application/json
TypeScript Definitions
Use the request body type in TypeScript.
Response Body
application/json
application/json
application/json
application/json
application/json
application/json
application/json
application/json
application/json
curl -X POST "https://example.com/orgs/string/api-keys/string/rotate" \ -H "Content-Type: application/json" \ -d '{}'{ "apiKey": { "id": "string", "org_id": "string", "name": "string", "key_prefix": "string", "last_used_at": "string", "created_at": "string", "revoked_at": "string", "expires_at": "string", "scopes": [ "string" ], "created_by": "string", "workspace_id": "string" }, "token": "string", "previous": { "id": "string", "expiresAt": "string" }}Mint an organization-bound API key POST
Requires a user session with api_keys.manage. API keys cannot mint keys. Both choices are required: what the key may do (`scopes`, a `template`, or `unscoped: true`) and when it stops (`expiresInDays` or `neverExpires: true`); a request missing either is refused with 400. Scopes narrow the creator's permissions, and [] grants none. Store the returned token securely: it is shown only once.
Revoke an API key DELETE
Requires a user session with api_keys.manage. API keys cannot call this operation. A sandbox's own Claims key (`rh_sb_`) cannot be revoked by hand: it answers 409 with `code: "sandbox_key_managed"`. To stop a sandbox using Claims, delete the sandbox or revoke the key it was issued from.