Rotate an API key
Mints a replacement key that inherits the original's scopes, name, and type by default, then revokes the original. Pass optional overrides in the request body to narrow / widen scopes, rename the key, or change its lifetime in the same call — fields you omit inherit from the original. Inherited scopes that have since been retired from the platform are dropped and listed under `droppedScopes` in the response; they granted nothing by then, so this is a cleanup rather than a narrowing. Scopes you pass explicitly are validated as on a fresh mint — an unknown one is a 400. Omit `expirationDays` to renew for the lifetime the key was last granted, at mint or by the latest rotate that chose one, capped at 365 days (a token that never expired gets 365); pass it to choose 1 to 365 days. There is no "never expire". The full key secret of the new key is only returned once in this response — store it securely and update wherever the old key was wired.
Authorization
Bearer JWT Authorization header using the Bearer scheme. Enter 'Bearer' [space] and then your token.
In: header
Path Parameters
The API key identifier to rotate
The tenant identifier
Optional overrides for the replacement key. Empty body is valid and means "no changes other than the secret."
New display name. Omit to keep the original key's name (the common case — rotation preserves the name so consumers recognise their key after rotation).
Number of days the replacement is valid for, from 1 to 365
(PersonalTokenLifetime.MaxDays). Omit to renew for
the same window the original carried, capped at 365 days (a token
that never expired gets 365). An explicit null, zero, or
anything over 365 is a 400 — personal access tokens always expire.
int32Explicit scope list to grant the replacement. Combined (unioned) with the expansion of RotateTokenRequest.Preset when both are supplied — same rules as the mint endpoint. Omit (null or empty array) to keep the original key's scopes.
Named preset to expand into a scope list. One of
observer, operator, developer,
maintainer, admin — see
Presets.NameList. Omit to keep the
original key's scopes.
Response Body
curl -X POST "https://api.fruxon.com/v1/tenants/string/tokens/string:rotate" \ -H "Content-Type: application/json" \ -d '{}'{
"id": "00000000-0000-0000-0000-000000000000",
"name": "string",
"token": "string",
"keyPrefix": "string",
"scopes": [
"string"
],
"droppedScopes": [
"string"
],
"createdAt": 0,
"expiresAt": 0,
"createdBy": "string"
}{
"type": "string",
"title": "string",
"status": 0,
"detail": "string",
"instance": "string",
"property1": null,
"property2": null
}{
"type": "string",
"title": "string",
"status": 0,
"detail": "string",
"instance": "string",
"property1": null,
"property2": null
}{
"type": "string",
"title": "string",
"status": 0,
"detail": "string",
"instance": "string",
"property1": null,
"property2": null
}Generate a new API key
Creates a new API key with the specified permissions. The full key secret is only returned once in this response - store it securely. Personal access tokens always expire: `expirationDays` is required, from 1 to 365.
List the API key scope vocabulary.
Returns every scope a key can carry (with its resource / action / intent breakdown) plus the named presets the mint endpoint accepts. Powers the dashboard mint flow and the CLI's `fruxon api-key-scopes list` command — clients shouldn't hardcode the vocabulary because that drifts the moment a new scope ships. No scope required: this is metadata anyone who can authenticate must be able to read (you can't mint a scoped key without knowing what scopes exist).