Rotate API key
Swap the key’s secret IN PLACE and return the new plaintext in result.plaintext_token EXACTLY ONCE: hand it to the user, never log it, unrecoverable. The key’s sid / name / permissions / expires_at are unchanged. The previous secret stays valid until result.previous_token_expires_at (now + grace_seconds, default 24h) so the agent can update config without downtime. Use when a secret leaks or before offboarding. NOT idempotent: each call mints a brand-new secret. Rotating a revoked/expired key → 409.
Contract:
- MCP tool
rotate_api_key, registry packagemcp.id/api_keys, mountid.access. - Operation
action, response envelopeaction. - Flags: dangerous: the MCP layer gates it behind a preview/commit token, and the effect cannot be undone through this API.
Authorizations
Access token issued by gtm.service.id. Its access_identity claim carries team_sid, actor_sid and actor_type, and that team scope is authoritative.
Team scope for tokens that do not carry one. Ignored when the token already names a team.
Path Parameters
API key sid (id_ak_…).
18^id_ak_Body
Request body of rotate_api_key.
0..604800 (≤7d); omit = 24h default; 0 = immediate cutover.
0 <= x <= 604800