Skip to content
Xaalis

Issue replacement and schedule old key revocation (owner only)

POST
/dashboard/v1/merchants/{merchantId}/{mode}/api-keys/{id}/roll
curl --request POST \
  --url http://localhost:4000/dashboard/v1/merchants/example/test/api-keys/example/roll \
  --header 'Content-Type: application/json' \
  --header 'idempotency-key: example' \
  --cookie better-auth.session_token=<better-auth.session_token> \
  --data '{ "grace_hours": 24 }'

Authorizations

Section titled “Authorizations”

Parameters

Section titled “ Parameters ”

Path Parameters

Section titled “Path Parameters”
merchantId
required
string
mode
required
string
Allowed values: test live
id
required
string

Header Parameters

Section titled “Header Parameters”
idempotency-key
required

Required retry-safe key; reuse it only for the same operation and request body

string
>= 1 characters <= 255 characters

Required retry-safe key; reuse it only for the same operation and request body

Request Bodyrequired

Section titled “Request Bodyrequired”
Media typeapplication/json
object
grace_hours

Old key remains valid for this many hours after a successful roll

integer
default: 24 >= 1 <= 72

Responses

Section titled “ Responses ”

201

Section titled “201”

Replacement key; secret shown once

Media typeapplication/json
object
object
required
string
Allowed values: api_key
id
required
string
mode
required
string
Allowed values: test live
display_prefix
required
string
last_used_at
required
string | null
revoked_at
required
string | null
scheduled_revoke_at
required
string | null
created_at
required
string
secret_key
required

Shown only in this issuance response; never stored or retrievable

string
previous_key
required
object
object
required
string
Allowed values: api_key
id
required
string
mode
required
string
Allowed values: test live
display_prefix
required
string
last_used_at
required
string | null
revoked_at
required
string | null
scheduled_revoke_at
required
string | null
created_at
required
string
Example
{
  "object": "api_key",
  "mode": "test",
  "previous_key": {
    "object": "api_key",
    "mode": "test"
  }
}

400

Section titled “400”

Invalid request

Media typeapplication/json
object
error
required
object
code
required
string
message
required
string
details
Examplegenerated
{
  "error": {
    "code": "example",
    "message": "example",
    "details": "example"
  }
}

401

Section titled “401”

Sign-in required

Media typeapplication/json
object
error
required
object
code
required
string
message
required
string
details
Examplegenerated
{
  "error": {
    "code": "example",
    "message": "example",
    "details": "example"
  }
}

403

Section titled “403”

Forbidden

Media typeapplication/json
object
error
required
object
code
required
string
message
required
string
details
Examplegenerated
{
  "error": {
    "code": "example",
    "message": "example",
    "details": "example"
  }
}

404

Section titled “404”

Not found

Media typeapplication/json
object
error
required
object
code
required
string
message
required
string
details
Examplegenerated
{
  "error": {
    "code": "example",
    "message": "example",
    "details": "example"
  }
}

409

Section titled “409”

Idempotency conflict or invalid state

Media typeapplication/json
object
error
required
object
code
required
string
message
required
string
details
Examplegenerated
{
  "error": {
    "code": "example",
    "message": "example",
    "details": "example"
  }
}