Wambesha

A referência da API está disponível apenas em inglês.

Accountkeys{keyId}rotate

POST/v1/account/keys/{keyId}/rotate

Apenas quota de chamadas

Issue a new secret for the key you are calling with; the old one keeps working for 24 hours. The new secret is shown exactly once.

Parâmetros

keyIdstring · uuid · no caminhoobrigatório
The id of the key making this request. A key may only rotate itself.
Mais
Must be the id of the key making this request.

Campos da resposta

keyobject · ApiKeySummary
One API key as the console shows it. Never carries the secret, and no endpoint anywhere returns one after creation - the store holds a SHA-256 hash and there is no code path that could produce the original.
secretstring
Shown ONCE. Never logged by us, never audited, never returned again.

Cabeçalhos de resposta

X-Request-ID
The id of this request, on every response - success or error. Quote it to support: it is how we find your request in our logs. An X-Request-ID you send is honoured and echoed back, so you can use your own; otherwise we generate one. /v1 error bodies carry no trace id of their own.
X-Quota-Reset
RFC 3339 instant at which the billing period rolls. Present on every response to a request whose key was metered - every 2xx, every error a handler returned, and the quota 429. Absent on a refusal that happens before metering: a missing or unknown key (401), a restricted key or a plan that does not carry the endpoint (403), a public demo-key gate refusal, and the pre-authentication flood throttle.
X-Calls-Remaining
Requests left in the period after this one, never below 0. Present whenever X-Quota-Reset is (see there for when a response carries no quota headers).
X-Verifications-Remaining
How many verifications you can still make before a limit stops you. The daily limit and the monthly allowance are counted separately; this is whichever of the two runs out first. Sent whenever X-Quota-Reset is.
X-Quota-Grace
true when THIS request fell inside the 10% grace band above a monthly ceiling. A grace request is served and is not billed; treat true as "back off now", not as headroom. Always true or false, never absent when the other quota headers are present.
Retry-After429
Seconds to wait before retrying. On every 429 - the quota hard stop, the public demo key's limits, and the pre-authentication flood throttle (which carries this header alone, because no key has been read yet).
X-Demo-Challenge-ModeApenas com a chave de demonstração
Sent only on responses to the public demo key. The value interactive asks the documentation page to show the visible verification widget - it is sent once a browser has made more than five runs in ten minutes or has received a 429. The page then repeats the header, X-Demo-Challenge-Mode: interactive, on its next request, with the widget's token in X-Demo-Challenge. Requests made with your own key never receive it.

Erros

Detalhes

Issues a NEW secret and keeps the old one working for 24 hours, so a deploy can roll without an outage. The new secret is returned exactly once.

A key may only rotate ITSELF. The presented key is the authorisation, so {keyId} must be the key making the call - rotating a different key needs a session, at /api/v1/developer/keys. Anything else would let one leaked key rotate every other key on the account.

Distinct from REVOCATION, which is immediate, has no grace window and cannot be undone.

Experimente

A carregar a chave de demonstração…

curl -X POST "https://api.wambesha.com/v1/account/keys/00000000-0000-0000-0000-000000000000/rotate" \
  -H "Authorization: Bearer YOUR_API_KEY"

Exemplo

{
  "key": {
    "id": "919203ec-bcde-4715-9aac-383351d23f97",
    "name": "cycle17 docs examples",
    "prefix": "wba_test_",
    "lastFour": "125e",
    "environment": "TEST",
    "createdAt": "2026-09-27T16:33:08Z",
    "lastUsedAt": null,
    "expiresAt": null,
    "revokedAt": null,
    "rotatedAt": null,
    "rotationGraceUntil": null,
    "scopes": [],
    "ipAllowlist": [],
    "referrerAllowlist": []
  },
  "secret": "wba_test_0ad12f98dc9bcf5a16fb537b7499125e"
}