Rotate a key: mints a successor with the same tenant/name/scopes (raw key returned ONCE) and gives the old key an exp...

Rotate a key: mints a successor with the same tenant/name/scopes (raw key returned ONCE) and gives the old key an expiry — default 24h overlap — so consumers can be moved without an outage. Admin, or the key’s own tenant. Auth-required.

POSTRequest

curl -X POST https://substrate.sloelabs.com/v1/abilities/key.rotate \
    -H "Authorization: Bearer $SLOE_API_KEY" \
    -H 'Content-Type: application/json' \
    -d '{"input":{"id":"<id>"}}'

Responses

200400401403404429501default

Response 200

The ability ran.

application/json

Example responseGenerated from schema

{
  "ok": true,
  "ability": "ability",
  "duration": 0
}

Response 400

The body is missing input, or input fails the ability’s schema (details holds the validation errors).

application/json

Example responseGenerated from schema

{
  "ok": true,
  "error": "error",
  "ability": "ability",
  "reason": "reason",
  "details": [
    {}
  ],
  "retryAfterMs": 0
}

Response 401

No bearer credential, or one the substrate does not recognise.

application/json

Example responseGenerated from schema

{
  "ok": true,
  "error": "error",
  "ability": "ability",
  "reason": "reason",
  "details": [
    {}
  ],
  "retryAfterMs": 0
}

Response 403

The credential is valid, but its scope does not include this ability.

application/json

Example responseGenerated from schema

{
  "ok": true,
  "error": "error",
  "ability": "ability",
  "reason": "reason",
  "details": [
    {}
  ],
  "retryAfterMs": 0
}

Response 404

No ability has this id.

application/json

Example responseGenerated from schema

{
  "ok": true,
  "error": "error",
  "ability": "ability",
  "reason": "reason",
  "details": [
    {}
  ],
  "retryAfterMs": 0
}

Response 429

Too many requests for this credential. retryAfterMs says when to retry.

application/json

Example responseGenerated from schema

{
  "ok": true,
  "error": "error",
  "ability": "ability",
  "reason": "reason",
  "details": [
    {}
  ],
  "retryAfterMs": 0
}

Response 501

The ability is declared but no handler is wired.

application/json

Example responseGenerated from schema

{
  "ok": true,
  "error": "error",
  "ability": "ability",
  "reason": "reason",
  "details": [
    {}
  ],
  "retryAfterMs": 0
}

Response default

The ability failed. The message is sanitized; a 5xx may be a transient upstream failure.

application/json

Example responseGenerated from schema

{
  "ok": true,
  "error": "error",
  "ability": "ability",
  "reason": "reason",
  "details": [
    {}
  ],
  "retryAfterMs": 0
}

Request body

Required

Yes

Content type

• application/json

• inputKeyRotateInputrequired
  Show 2 properties

  • idstringrequired

    Key id (key_…) from key.list.

  • overlapHoursnumberoptional

    How long the OLD key keeps working. 0..336, default 24.

• contextCallContextoptional

  Optional call context. The tenant always comes from the credential: tenantId is honoured only by a credential allowed to address sub-tenants, and then nests under the credential’s own tenant.

  Show 3 properties

  • tenantIdstringoptional

    Sub-tenant to act for (sub-tenant credentials only).

  • runIdstringoptional

    The trust run (from trust.preflight) this call executes under.

  • verticalIdstringoptional

    Vertical to attribute created records to.

Returns

Schema shown for 200 · application/json

• result

  The ability’s return value. Its shape depends on the ability.