Rotate an API key
Issues a new secret for the same key record, so policies and configuration links attached to it survive. The previous secret stops working immediately across the whole cluster. A revoked key cannot be rotated.
The response carries the new plaintext once. It does not include
configurations; read the key back if you need them.
Authorizations
A machine credential, qk_ followed by its secret. Only a hash of the
secret is stored, so a key is displayed exactly once, when it is created
or rotated. A key reaches only the configurations it is linked to.
It may also be sent as Authorization: Bearer qk_..., which is
recognised by the prefix.
Path Parameters
The API key's id. Not the key itself, and not its prefix.
Response
Rotated. The new plaintext is returned once.
The owning user. Classification clearance for this key resolves through this user and their role.
The first twelve characters of the key, which is all that is stored in readable form. Useful for naming a key in a log without quoting the secret.
"qk_Q8oGyqBl3"
Null while the key is usable. Revocation is permanent.
The plaintext, returned once and never recoverable afterwards. Only a hash of it is stored.
"qk_Q8oGyqBl3Icos_EYb8pitlJvMRHrsjUwUpfwoN7f9PKBINZ9-kBM"
The configurations this key may reach. An empty array means none: the grant is explicit, so a newly minted key cannot touch data until somebody says which data it is for.
Absent, rather than empty, on the response to a rotation, which does not load them.