Skip to content

Rotate Api Key

POST
/api-keys/{api_key_id}/rotate

Rotate a key, preserving its mode, scopes and agency status.

The old key is deleted and a policy-equivalent replacement is minted; the new token is returned exactly once. Ownership is enforced by the org-scoped lookup below (mirroring the delete route) plus rotate_api_key’s own org-scoped read-back (campaign_builder/services/propelauth.py).

Guard 4 (mode non-escalation) applies here too — see module docstring point 4. Rotation PRESERVES the target key’s mode, so without this a test-mode caller could rotate a live key and receive a brand-new live token (while invalidating the working live key). That is the same escalation the create route coerces away, so refuse it here rather than coerce: a rotation cannot be silently downgraded to test without destroying a working live key.

Authorizations

Parameters

Path Parameters

api_key_id
required
string

Header Parameters

X-Target-Org-Id
Any of:
string

Request Body required

Request to rotate a key. Mode, scopes and agency status are preserved from the key being rotated — none are settable here.

object
expires_in_days
Any of:
integer
>= 1 <= 365
name
Any of:
string
>= 1 characters <= 100 characters

Responses

200

Successful Response

object
data
required

Response after minting a key.

api_key_token is returned exactly once, here, at creation. No other endpoint on this router — or the app’s — ever returns it again.

object
api_key_id
required
string
api_key_token
required
string
mode
string
default: live
name
required
string
scopes
Array<string>
pagination
Any of:
object
has_next
required

Whether there are more pages

boolean
limit
required

Items per page

integer
next_cursor
Any of:
string
page
required

Current page number (1-indexed)

integer
total
required

Total number of items

integer

422

Validation Error

object
detail
Array<object>
object
loc
required
Array
msg
required
string
type
required
string