Rotates an active workspace-managed key and returns its new credential only in this original response. Existing tokens stop authenticating; key configuration, scope and expiration remain. Requires current workspace API access management permission. User-owned targets and inactive keys are forbidden, preserving the existing administration policy. Missing/foreign keys are 404. Optional If-Match uses the current inventory GET validator under the key lock. The response is excluded from API log bodies and Redis replay results, carries Cache-Control no-store and no ETag. A retained Idempotency-Key returns idempotency_outcome_unknown (409) without re-executing; Redis loss/expiry is not durable exactly-once delivery. A lost response may require deliberate new rotation with a separately authorized credential. Inventory GET never reveals tokens. Self-rotation invalidates the caller's old token after the response.
| Time | Status | User Agent | |
|---|---|---|---|
Retrieving recent requests… | |||