Rotate an API key
Issue a successor with the same name, scopes and reach, and retire this one. The response carries the new secret, and nothing shows it again.
Mint conditions apply, because whoever rotates walks away with a working secret: the scopes are re-checked against what this person holds today, so a key cannot outlive its creator's authority by being rotated. That is the same precondition editing carries, and it is literally the same call.
grace_period_hours keeps the old secret alive for a while, so a deploy can
reach every consumer before it stops.
bearerAuthAuthorizationBearer <token>API token generated from the fastmon dashboard (Account → API Token) or at organization level (fmo_…, one that outlives its creator). Send as Authorization: Bearer fm_... or paste the full token (including its prefix) into the Authorize dialog.
org_id*Org Iduuidkey_id*Key Iduuidapplication/json- body
Replace a key's secret, optionally letting the old one live a little.
The successor copies name, scopes and reach, so nothing about what the credential may do changes - only the secret does. Rotating therefore carries the mint conditions: whoever does it sees a new secret, and it is checked against what they hold today rather than what the original minter held.
current_password?|The account's password, when it has neither a passkey nor 2FA.
totp_code?|Code from the authenticator app, when 2FA is on and there is no passkey.
passkey_challenge_id?|Challenge from POST /auth/session/webauthn/options, required together with passkey_assertion whenever the account has a passkey.
passkey_assertion?|The WebAuthn assertion answering that challenge.
grace_period_hours?Grace Period HoursHow long the old secret keeps working, in hours. 0, the default, kills it immediately, which is what a leak wants. At most 24.
0 <= value <= 240Successful Response
application/json- response
Response to minting: the info plus the cleartext secret, which is returned exactly once and never stored.
id*IdIdentifier of the key.
uuidkind*ApiKeyKindWhether the key belongs to a person or to an organization.
"personal""org"name?NameLabel the key is recognised by.
prefix*PrefixNon-secret lookup prefix: the scheme (fm_ for a personal key, fmo_ for an organization's) plus the first characters of the secret.
last4?Last4Last four characters of the secret, to tell two keys apart.
scopes?array<string>Permissions this key carries.
[]expires_at?Expires AtWhen the key stops working; absent means never.
date-timelast_used_at?Last Used AtAbsent until the key is first used.
date-timereach*Which organizations the key may act in: the ones it was issued for, or, for a key issued to an agency, its clients as they stand right now.
created_at*Created AtWhen the key was minted.
date-timerevoked_at?Revoked AtAbsent while the key is live. Only listings that ask for revoked keys ever see a value here.
date-timeeditable?EditableWhether the caller may change this key: its scopes, its expiry, its name, and rotating it. False for a key that holds permissions the caller does not. Revoking is never gated by it.
truevia_partner_org_id?Via Partner Org IdThe partner organization whose member minted this org key. The key keeps working after that partnership ends. Absent otherwise.
uuidkey*KeyThe secret, in full. It is returned here and nowhere else, and it is not stored - a lost secret is replaced by rotating the key.
curl -X POST 'https://api.fastmon.eu/organizations/497f6eca-6276-4993-bfeb-53cbbbba6f08/api-keys/497f6eca-6276-4993-bfeb-53cbbbba6f08/rotate' \ -H 'Content-Type: application/json' \ -d '{}'{ "id": "497f6eca-6276-4993-bfeb-53cbbbba6f08", "kind": "personal", "name": "string", "prefix": "string", "last4": "string", "scopes": [], "expires_at": "2019-08-24T14:15:22Z", "last_used_at": "2019-08-24T14:15:22Z", "reach": { "scope": "string", "partner_org_id": "6d083317-c55a-4f41-82ae-8c86d8187f47", "organization_ids": [], "organization_count": 0 }, "created_at": "2019-08-24T14:15:22Z", "revoked_at": "2019-08-24T14:15:22Z", "editable": true, "via_partner_org_id": "4449850c-ca66-4d3c-b6e6-920e855223d4", "key": "string"}