iam.api_key.rotate

Rotate an API key: mint a NEW token generation on the SAME key and give the previous generations a deadline instead of killing them, so a running integration survives its own redeploy. Returns the new raw token exactly once. overlap_hours defaults to 24; 0 is an immediate cut-over.

• Scope: admin.users.write
• System: no
• Reachable from: POST /v1/commands/iam.api_key.rotate (tenant credential) · MCP tool iam.api_key.rotate · SDK client.call('iam.api_key.rotate', …)
• Events: iam.api_key.rotated

Input (JSON Schema)

{
  "properties": {
    "api_key_id": {
      "minLength": 1,
      "type": "string"
    },
    "expires_in_days": {
      "maximum": 3650,
      "minimum": 1,
      "type": "integer"
    },
    "never_expires": {
      "type": "boolean"
    },
    "overlap_hours": {
      "maximum": 8760,
      "minimum": 0,
      "type": "integer"
    }
  },
  "required": [
    "api_key_id"
  ],
  "type": "object"
}

Result (200)

{
  "additionalProperties": false,
  "properties": {
    "api_key_id": {
      "type": "string"
    },
    "credential_id": {
      "type": "string"
    },
    "expires_at": {
      "anyOf": [
        {
          "type": "string"
        },
        {
          "type": "null"
        }
      ]
    },
    "previous_expires_at": {
      "type": "string"
    },
    "token": {
      "type": "string"
    }
  },
  "required": [
    "api_key_id",
    "credential_id",
    "token",
    "expires_at",
    "previous_expires_at"
  ],
  "type": "object"
}

Errors

validation_failed (400) · unauthorized (401) · forbidden (403) · conflict (409) · internal (500)