Rotate an API key: mint a replacement and revoke the predecessor, in one transaction.

POST

/account/api_key/{api_key_id}/rotate

const url = 'https://api.siteqwality.com/account/api_key/2489E9AD-2EE2-8E00-8EC9-32D5F69181C0/rotate';
const options = {method: 'POST', headers: {Authorization: 'Bearer <token>'}};

try {
  const response = await fetch(url, options);
  const data = await response.json();
  console.log(data);
} catch (error) {
  console.error(error);
}

curl --request POST \
  --url https://api.siteqwality.com/account/api_key/2489E9AD-2EE2-8E00-8EC9-32D5F69181C0/rotate \
  --header 'Authorization: Bearer <token>'

Because the secret is hashed at rest there is no “reveal it again”, so rotation is how a customer recovers from a lost or leaked key. The new key inherits the old one’s name, type, scopes, and expiry, so a rotated credential drops straight into the same config slot.

The old secret stops working the moment this returns; there is no grace period. A caller that needs overlap should instead create a second key, deploy it, then revoke the first.

Authorizations

bearer_auth

Parameters

Path Parameters

api_key_id

required

string format: uuid

API key identifier

Responses

200

New key; the secret is only returned once

application/json

Response for create and rotate, the ONLY places a full secret ever appears. It is not stored and cannot be retrieved again.

object

api_key

required

One API key in list responses. Never contains the secret: after creation the secret exists only in the customer’s hands.

object

required

string format: uuid

account_id

required

string format: uuid

friendly_name

string | null

key_prefix

required

First 8 characters of the secret, kept in plaintext for display.

string

key_last_four

required

Last 4 characters of the secret, kept in plaintext for display.

string

key_type

required

What a customer API key is allowed to do.

Mirrors the Datadog split between an API key (telemetry push) and an application key (full API access), collapsed into one credential with a type so the ingest path and the management path can share a table.

string

Allowed values: ingest full

scopes

required

Empty means unrestricted.

Array<string>

status

required

Lifecycle state of a key, derived rather than stored so it can never disagree with the timestamps.

string

Allowed values: active expired revoked

created_at

required

string format: date-time

last_used_at

string | null format: date-time

expires_at

string | null format: date-time

revoked_at

string | null format: date-time

secret

required

The full secret. Shown exactly once; store it now.

string

Example

{
  "api_key": {
    "key_type": "ingest",
    "status": "active"
  }
}

401

Missing or invalid authentication

404

API key not found or already revoked

500

Internal server error