Skip to main content
POST

Authorizations

​
Authorization
string
header
required

Primary scheme: Authorization: Key <key_id>:<secret>.

Path Parameters

​
key_id
string
required

The key's public identifier.

Body

application/json
​
grace_period_seconds
integer | null

Seconds the old secret keeps authenticating after the rotation; omitted means the service default (24h).

Required range: x >= 0

Response

Successful Response

​
key_id
string
required

The key's public identifier — unchanged by rotation.

​
credential
string
required

The new <key_id>:<secret> pair — a valid Bearer credential, shown exactly once, like at create.

​
kind
enum<string>
required

Personal keys die with the member; service keys belong to the workspace.

Available options:
personal,
service
​
name
string | null

Human-readable label for the key.

​
scopes
string[] | null

Scopes granted to the key; null means full access (a legacy key predating scopes).

​
workspace_id
string | null

The workspace the key bills and acts in.

​
expires_at
string<date-time> | null

ISO-8601 instant the key stops authenticating; null means it never expires.

​
previous_secret_expires_at
string<date-time> | null

ISO-8601 instant the previous secret stops authenticating — the end of the grace window.