Re-roll an API key

POST

/v1/keys/{id}/reroll

curl --request POST \
  --url https://api.overwatch.weareheavy.dev/v1/keys/example/reroll \
  --header 'Authorization: Bearer <token>'

• Production

Rotate a key’s secret: mint a fresh key under the same name and site scope, then delete the old one. The new key keeps the old key’s remaining lifetime (rotation doesn’t extend expiry); a key with no expiry stays without one. Session-only, owner/admin. The plaintext is returned once.

Authorizations

• BearerAuth

Parameters

Path Parameters

id

required

string

The API key’s id (from GET /v1/keys).

Responses

201

The replacement key. The old key no longer works.

Media typeapplication/json

A freshly minted key. key is the plaintext, shown only in this response.

object

id

required

string

name

required

string | null

key

required

The plaintext API key (wah_…). Store it now — it is never shown again.

string

siteIds

required

The key’s site scope, or null for full organization access.

Array<string> | null

Example^generated

{
  "id": "example",
  "name": "example",
  "key": "example",
  "siteIds": [
    "2489E9AD-2EE2-8E00-8EC9-32D5F69181C0"
  ]
}

401

Missing or invalid credentials.

Media typeapplication/json

object

error

required

A human-readable error message.

string

Example

{
  "error": "invalid api key"
}

403

A dashboard session is required (API-key callers are rejected), or the session’s role does not allow this action.

Media typeapplication/json

object

error

required

A human-readable error message.

string

Example

{
  "error": "a dashboard session is required"
}

404

No key with that id exists in your organization.

Media typeapplication/json

object

error

required

A human-readable error message.

string

Example

{
  "error": "key not found"
}