Rotate a workspace-managed API credential

Rotates an active workspace-managed key and returns its new credential only in this original response. Existing tokens stop authenticating; key configuration, scope and expiration remain. Requires current workspace API access management permission. User-owned targets and inactive keys are forbidden, preserving the existing administration policy. Missing/foreign keys are 404. Optional If-Match uses the current inventory GET validator under the key lock. The response is excluded from API log bodies and Redis replay results, carries Cache-Control no-store and no ETag. A retained Idempotency-Key returns idempotency_outcome_unknown (409) without re-executing; Redis loss/expiry is not durable exactly-once delivery. A lost response may require deliberate new rotation with a separately authorized credential. Inventory GET never reveals tokens. Self-rotation invalidates the caller's old token after the response.

Recent Requests
Log in to see full request history
TimeStatusUser Agent
Retrieving recent requests…
LoadingLoading…
Path Params
string
required
^api_[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{12}$

Public id that is created from the type prefix of the corresponding resource and its UUID. I.e : For an API key, a valid value would be : api_0197c8f2-5a6b-7cde-8f12-3456789abcde

Headers
string
length between 1 and 255

Optional unique key for best-effort duplicate suppression of this one-time response. The original successful response is returned to the caller but never retained in API log bodies or Redis replay results. Only an unresolved reservation is retained for 24 hours by default; a matching retry returns 409 idempotency_outcome_unknown without repeating the operation or revealing its secret. A concurrent request returns 409 idempotency_key_in_use; a changed request returns 422 idempotency_key_mismatch. An unavailable reservation store returns 503 before execution. A 4xx rejection releases its reservation; interruption after execution or loss of the success response requires inspection and a deliberate new operation. Redis expiry/eviction or explicit server-side disabling removes protection; this is not durable exactly-once execution. Use the target GET to inspect current metadata and obtain its validator, then a new key only when intentionally rotating again.

string

Optional precondition. Send the quoted ETag from a GET of this resource. The mutation only runs if a strong tag matches the current representation, checked under the write lock. A comma-separated list is allowed; '*' requires an existing representation. Weak tags never match. Omit this header for an unconditional write. For an action, use the ETag from GET of the target resource, without the action suffix. A stale tag returns 412; read the current state before retrying.

string
enum
Defaults to application/json

Generated from available response content types

Allowed:
Responses

Language
Credentials
Bearer
LoadingLoading…
Response
Click Try It! to start a request and see the response here! Or choose an example:
application/json
application/problem+json