API reference / Apps / Rotate an app's API key

Rotate an app's API key

POST/apps/{appId}/rotate-key

Authenticate with an operator token or a signed-in Foliot Console session.

An operator token, or a signed-in person who is an owner of the app’s workspace. Never an app key: an app must not be able to mint its own replacement. Immediate: the old key stops working at once. Unlike the signing secret there is no rollover, because the caller receives the new key before it needs it. Recorded in the credential history with the caller as the actor.

Path parameters

appId

string

REQUIRED

The app's name.

Request body

reason

string

OPTIONAL

Why. Optional; recorded with the action.

max length 1000

Responses

200 object OK

400 Error Invalid request.

401 Error Missing, malformed or unknown bearer token.

403 Error The token is valid but not permitted on this route.

404 Error No such resource.

503 Error A dependency this route needs is unreachable.

cURL

curl -X POST "https://api.foliot.app/apps/{appId}/rotate-key" \
  -H "Authorization: Bearer $FOLIOT_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"reason":"string"}'

RESPONSE 200 OK

{
  "apiKey": "string"
}