Skip to main content

Rotate the key you are calling with

POST 
/v1/api-user/keys/rotate

Creates a new key and answers it once. Store it in your secret store before you use it. The key you called with keeps working for the API user's grace period (replaced_key.works_until, default 24 hours) so every system that uses it can switch; after that it is refused with api_key_rotated. While a replaced key is in its grace period, every answer to it carries the header X-API-Key-Grace-Until.

A key that was already rotated cannot be rotated again (rotate its replacement). At most 5 keys per API user can be active or in their grace period, and at most 10 rotations an hour. The API user's notification addresses get an email and the api_key.rotated webhook event is sent. The answer is never logged.

Request​

Responses​

The new key, shown once