> ## Documentation Index > Fetch the complete documentation index at: https://tbd-6fc993ce-hypeship-changelog-august-13.mintlify.site/llms.txt > Use this file to discover all available pages before exploring further. # Rotate an API key > Rotate an API key. Issues a new key that copies the name and project of the rotated key, and schedules the rotated key to expire after a grace period so in-flight callers can swap over. The new plaintext key is returned once. ## OpenAPI ````yaml https://api.onkernel.com/spec.json post /org/api_keys/{id}/rotate openapi: 3.1.0 info: description: Developer tools and cloud infrastructure for AI agents to use web browsers title: Kernel API version: 0.1.0 servers: - description: API Server url: https://api.onkernel.com security: - bearerAuth: [] tags: - description: Create and manage browser sessions. name: Browsers - description: Control mouse, keyboard, and screen on the browser instance. name: Browser Computer Controls - description: Execute Playwright code against the browser instance. name: Browser Playwright - description: Read, write, and manage files on the browser instance. name: Browser Filesystem - description: Execute and manage processes on the browser instance. name: Browser Processes - description: Record and manage browser session video replays. name: Browser Replays - description: Stream logs from the browser instance. name: Browser Logs - description: Stream live telemetry events from a browser session. name: Browser Telemetry - description: Create, list, retrieve, and delete browser profiles. name: Profiles - description: Create and manage proxy configurations for routing browser traffic. name: Proxies - description: Create, list, retrieve, and delete browser extensions. name: Extensions - description: Create and manage browser pools for acquiring and releasing browsers. name: Browser Pools - description: Inspect the identity and authorization context for the current request. name: Authentication - description: >- Create and manage auth connections for automated credential capture and login. name: Managed Auth - description: Create and manage credentials for authentication. name: Credentials - description: Configure external credential providers like 1Password. name: Credential Providers - description: List applications and versions. name: Apps - description: Create and manage app deployments and stream deployment events. name: Deployments - description: Invoke actions and stream or query invocation status and events. name: Invocations - description: Read and manage organization-level limits. name: Organization - description: | Create and manage projects for resource isolation within an organization. When projects are disabled for the organization, project operations return `404` with code `projects_disabled`. name: Projects - description: Create and manage API keys for organization and project-scoped access. name: API Keys - description: Read audit log records for the authenticated organization. name: Audit Logs - description: Resolve browser and proxy recommendations for bot-protected sites. name: Site Configs paths: /org/api_keys/{id}/rotate: post: tags: - API Keys summary: Rotate an API key description: >- Rotate an API key. Issues a new key that copies the name and project of the rotated key, and schedules the rotated key to expire after a grace period so in-flight callers can swap over. The new plaintext key is returned once. operationId: rotateApiKey parameters: - description: API key ID in: path name: id required: true schema: type: string requestBody: content: application/json: schema: $ref: '#/components/schemas/RotateApiKeyRequest' required: false responses: '201': content: application/json: schema: $ref: '#/components/schemas/CreatedApiKey' description: New API key created from the rotation '400': $ref: '#/components/responses/BadRequest' '401': $ref: '#/components/responses/Unauthorized' '404': $ref: '#/components/responses/NotFound' '500': $ref: '#/components/responses/InternalError' security: - bearerAuth: [] components: schemas: RotateApiKeyRequest: properties: days_to_expire: description: >- Lifetime in days for the new key, up to 3650. Omit to reuse the rotated key's original lifetime, or never-expires if it had none. example: 30 maximum: 3650 minimum: 1 nullable: true type: integer expire_in_days: description: >- Grace period in days before the rotated key expires. Use 0 to expire it immediately. Omit for the default grace period of 7 days. example: 7 maximum: 3650 minimum: 0 nullable: true type: integer type: object CreatedApiKey: allOf: - $ref: '#/components/schemas/ApiKey' - properties: key: description: Plaintext API key. Only returned once when the key is created. example: sk_1234abcd type: string required: - key type: object description: >- API key returned immediately after creation. Includes the plaintext key once. ApiKey: properties: created_at: description: When the API key was created format: date-time type: string created_by: $ref: '#/components/schemas/ApiKeyCreator' deleted_at: description: >- When the API key was deleted (soft-deleted). Null for keys that have not been deleted. format: date-time nullable: true type: string expires_at: description: When the API key expires format: date-time nullable: true type: string id: description: Unique API key identifier example: ckv9w8q2f000001l5r3j7k9m4 type: string masked_key: description: Masked version of the API key example: sk_1234...abcd type: string name: description: >- Label for the API key. API keys are not addressable by name; use the ID or key identifier for stable references. example: production type: string project_id: description: Project identifier for project-scoped API keys. Null means org-wide. example: proj_abc123 nullable: true type: string project_name: description: >- Project name for project-scoped API keys. Null means the key is org-wide or the project name is unavailable. example: Production nullable: true type: string required: - id - name - created_at - created_by - expires_at - deleted_at - project_id - project_name - masked_key type: object Error: properties: code: description: Application-specific error code (machine-readable) example: bad_request type: string details: description: Additional error details (for multiple errors) items: $ref: '#/components/schemas/ErrorDetail' type: array inner_error: $ref: '#/components/schemas/ErrorDetail' message: description: Human-readable error description for debugging example: 'Missing required field: app_name' type: string required: - code - message type: object ApiKeyCreator: properties: email: description: Email address of the creator. example: user@example.com format: email type: string id: description: Kernel user ID of the creator. example: user-abc123 type: string name: description: Display name of the creator, if available. example: Jane Doe nullable: true type: string required: - id - email - name type: object ErrorDetail: properties: code: description: Lower-level error code providing more specific detail example: invalid_input type: string message: description: Further detail about the error example: Provided version string is not semver compliant type: string type: object responses: BadRequest: content: application/json: schema: $ref: '#/components/schemas/Error' description: Bad Request – invalid input Unauthorized: content: application/json: schema: $ref: '#/components/schemas/Error' description: Unauthorized – missing or invalid authorization token NotFound: content: application/json: schema: $ref: '#/components/schemas/Error' description: Resource not found InternalError: content: application/json: schema: $ref: '#/components/schemas/Error' description: Internal Server Error securitySchemes: bearerAuth: scheme: bearer type: http ````