Rotate API key
Issues a new secret for the same key record, so policies and configuration links attached to it survive. The previous secret stops working immediately across the whole cluster.
Authorizations
A machine credential, qk_ followed by its secret. The first twelve
characters are an indexed prefix; the rest is compared in constant time
against a stored SHA-256 hash. A key reaches only the configurations it is
linked to.
It may also be sent as Authorization: Bearer qk_..., which is
recognised by the prefix.
Path Parameters
Response
Rotated. The new plaintext is returned once.
The owning user. Classification clearance for this key resolves through this user and their role.
The indexed first twelve characters.
"qk_TEcj6-ebd"
The plaintext, returned once and never recoverable afterwards. Only its SHA-256 hash is stored.
"qk_TEcj6-ebdBWLHz-BBorydQlxrjIuRJYG"
The configurations this key may reach. An empty list means none: the grant is explicit, so a newly minted key cannot touch data until somebody says which data it is for.