> ## Documentation Index
> Fetch the complete documentation index at: https://docs.naturalead.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# Rotate API Key

> Rotates an API key by revoking the existing key and creating a new one
with the same name, scopes, and environment. The new full key is returned
only once. The old key is immediately invalidated.
Requires `api_keys:manage` permission.




## OpenAPI

````yaml POST /api/api-keys/{id}/rotate
openapi: 3.1.0
info:
  title: Naturalead API Keys API
  version: 1.0.0
  description: >
    API for managing programmatic API keys in the Naturalead platform.

    All endpoints require API key authentication and are scoped to the caller's
    account.
servers:
  - url: '{baseUrl}'
    description: API server
    variables:
      baseUrl:
        default: http://localhost:3001
security:
  - BearerAuth: []
tags:
  - name: API Keys
    description: API key lifecycle management (create, list, revoke, rotate, delete)
paths:
  /api/api-keys/{id}/rotate:
    post:
      tags:
        - API Keys
      summary: Rotate API key
      description: >
        Rotates an API key by revoking the existing key and creating a new one

        with the same name, scopes, and environment. The new full key is
        returned

        only once. The old key is immediately invalidated.

        Requires `api_keys:manage` permission.
      operationId: rotateApiKey
      parameters:
        - name: id
          in: path
          required: true
          description: API key ID to rotate
          schema:
            type: string
      responses:
        '201':
          description: Key rotated successfully
          content:
            application/json:
              schema:
                type: object
                properties:
                  apiKey:
                    $ref: '#/components/schemas/ApiKey'
                  fullKey:
                    type: string
                    description: The new full API key (shown only once)
                required:
                  - apiKey
                  - fullKey
        '404':
          description: API key not found or already revoked
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
        '500':
          $ref: '#/components/responses/InternalError'
components:
  schemas:
    ApiKey:
      type: object
      properties:
        _id:
          type: string
          description: Unique key identifier
        accountId:
          type: string
          description: Account this key belongs to
        name:
          type: string
          description: Human-readable key name
        keyPrefix:
          type: string
          description: Key prefix (e.g. nl_live_ or nl_test_)
        keyHint:
          type: string
          description: Last 4 characters of the key for identification
        scopes:
          type: array
          items:
            type: string
          description: RBAC permissions granted to this key
        environment:
          type: string
          enum:
            - live
            - test
        status:
          type: string
          enum:
            - active
            - revoked
            - expired
        expiresAt:
          type: string
          format: date-time
          nullable: true
        lastUsedAt:
          type: string
          format: date-time
          nullable: true
        createdAt:
          type: string
          format: date-time
      required:
        - _id
        - name
        - keyPrefix
        - keyHint
        - scopes
        - environment
        - status
        - createdAt
    Error:
      type: object
      properties:
        error:
          type: string
          description: Error message
      required:
        - error
  responses:
    InternalError:
      description: Internal server error
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/Error'
  securitySchemes:
    BearerAuth:
      type: http
      scheme: bearer
      description: Bearer token using an API key (format nl_live_* or nl_test_*)

````