> ## Documentation Index
> Fetch the complete documentation index at: https://docs.staging.questra.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# Rotate API key

> Issues a new secret and invalidates the previous one. Scopes are unchanged. The new `key` is returned once.



## OpenAPI

````yaml /openapi/program.openapi.json post /api_keys/{apiKeyId}/rotate
openapi: 3.1.0
info:
  title: Questra Program API
  version: 0.0.1
  description: >-
    REST API for the Questra Program product. Browser users authenticate through
    Questra Auth SSO; automation uses workspace-scoped API keys (`Authorization:
    Bearer qpk_live_…`). API keys carry scopes enforced before handlers.
    Outbound webhooks follow Standard Webhooks (at-least-once delivery;
    consumers must be idempotent).
servers:
  - url: /v1
    description: Program API base path
security: []
paths:
  /api_keys/{apiKeyId}/rotate:
    post:
      tags:
        - API keys
      summary: Rotate API key
      description: >-
        Issues a new secret and invalidates the previous one. Scopes are
        unchanged. The new `key` is returned once.
      parameters:
        - schema:
            type: string
            format: uuid
          required: true
          name: apiKeyId
          in: path
      responses:
        '200':
          description: Rotated API key with new secret
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/RotateApiKeyResponse'
        '401':
          description: Unauthorized
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorBody'
        '403':
          description: Forbidden
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorBody'
        '404':
          description: Not found
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorBody'
      security:
        - bearerAuth: []
components:
  schemas:
    RotateApiKeyResponse:
      type: object
      properties:
        data:
          $ref: '#/components/schemas/ApiKeyWithSecret'
      required:
        - data
    ErrorBody:
      type: object
      properties:
        error:
          type: string
        message:
          type: string
        resource:
          type: string
        slug:
          type: string
        file_id:
          type: string
        endpoint_id:
          type: string
        event_id:
          type: string
        delivery_id:
          type: string
        api_key_id:
          type: string
        integration_id:
          type: string
        audit_id:
          type: string
        status:
          type: string
        details: {}
        question_ids:
          type: array
          items:
            type: string
        survey_ids:
          type: array
          items:
            type: string
        revisions:
          type: array
          items:
            type: number
      required:
        - error
    ApiKeyWithSecret:
      allOf:
        - $ref: '#/components/schemas/ApiKey'
        - type: object
          properties:
            key:
              type: string
              example: qpk_live_a1b2c3d4e5f6g7h8i9j0k1l2m3n4o5p6
              description: >-
                Full API key secret. Returned only on create and rotate — store
                it securely; it cannot be retrieved again.
          required:
            - key
    ApiKey:
      type: object
      properties:
        id:
          type: string
          format: uuid
        name:
          type: string
          example: CI deploy
        key_hint:
          type: string
          example: …a1b2
          description: >-
            Masked suffix of the secret key for display. The full key is never
            returned after create/rotate.
        scopes:
          type: array
          items:
            type: string
            enum:
              - '*'
              - meta:read
              - members:read
              - members:write
              - billing:read
              - billing:write
              - privacy:read
              - privacy:write
              - integrations_settings:read
              - integrations_settings:write
              - programming_settings:read
              - programming_settings:write
              - api_keys:read
              - api_keys:write
              - webhooks:read
              - webhooks:write
              - surveys:read
              - surveys:write
              - surveys:share
              - integrations:read
              - integrations:write
              - workflows:read
              - workflows:write
          minItems: 1
          example:
            - surveys:read
            - surveys:write
          description: >-
            Granted scopes. `write` implies `read` for the same resource; `*`
            grants all Program API access.
        enabled:
          type: boolean
        last_used_at:
          type:
            - string
            - 'null'
          format: date-time
        expires_at:
          type:
            - string
            - 'null'
          format: date-time
        created_at:
          type: string
          format: date-time
        updated_at:
          type: string
          format: date-time
      required:
        - id
        - name
        - key_hint
        - scopes
        - enabled
        - last_used_at
        - expires_at
        - created_at
        - updated_at
  securitySchemes:
    bearerAuth:
      type: http
      scheme: bearer
      description: Questra Program session token or workspace API key (`qpk_live_…`)

````