Skip to main content
POST
Rotate API key

Authorizations

X-Qanapi-Authorization
string
header
required

A machine credential, qk_ followed by its secret. The first twelve characters are an indexed prefix; the rest is compared in constant time against a stored SHA-256 hash. A key reaches only the configurations it is linked to.

It may also be sent as Authorization: Bearer qk_..., which is recognised by the prefix.

Path Parameters

id
string<uuid>
required

Response

Rotated. The new plaintext is returned once.

id
string<uuid>
required
user_id
string<uuid>
required

The owning user. Classification clearance for this key resolves through this user and their role.

name
string
required
prefix
string
required

The indexed first twelve characters.

Example:

"qk_TEcj6-ebd"

created_at
string<date-time>
required
key
string
required

The plaintext, returned once and never recoverable afterwards. Only its SHA-256 hash is stored.

Example:

"qk_TEcj6-ebdBWLHz-BBorydQlxrjIuRJYG"

revoked_at
string<date-time> | null
last_used_at
string<date-time> | null
configurations
object[]

The configurations this key may reach. An empty list means none: the grant is explicit, so a newly minted key cannot touch data until somebody says which data it is for.