Wambesha

API 參考文件僅提供英文版。

Accountkeys{keyId}rotate

POST/v1/account/keys/{keyId}/rotate

僅計入呼叫配額

Issue a new secret for the key you are calling with; the old one keeps working for 24 hours. The new secret is shown exactly once.

參數

keyIdstring · uuid · 位於路徑中必填
The id of the key making this request. A key may only rotate itself.
更多
Must be the id of the key making this request.

回應欄位

keyobject · ApiKeySummary
One API key as the console shows it. Never carries the secret, and no endpoint anywhere returns one after creation - the store holds a SHA-256 hash and there is no code path that could produce the original.
secretstring
Shown ONCE. Never logged by us, never audited, never returned again.

回應標頭

X-Request-ID
The id of this request, on every response - success or error. Quote it to support: it is how we find your request in our logs. An X-Request-ID you send is honoured and echoed back, so you can use your own; otherwise we generate one. /v1 error bodies carry no trace id of their own.
X-Quota-Reset
RFC 3339 instant at which the billing period rolls. Present on every response to a request whose key was metered - every 2xx, every error a handler returned, and the quota 429. Absent on a refusal that happens before metering: a missing or unknown key (401), a restricted key or a plan that does not carry the endpoint (403), a public demo-key gate refusal, and the pre-authentication flood throttle.
X-Calls-Remaining
Requests left in the period after this one, never below 0. Present whenever X-Quota-Reset is (see there for when a response carries no quota headers).
X-Verifications-Remaining
How many verifications you can still make before a limit stops you. The daily limit and the monthly allowance are counted separately; this is whichever of the two runs out first. Sent whenever X-Quota-Reset is.
X-Quota-Grace
true when THIS request fell inside the 10% grace band above a monthly ceiling. A grace request is served and is not billed; treat true as "back off now", not as headroom. Always true or false, never absent when the other quota headers are present.
Retry-After429
Seconds to wait before retrying. On every 429 - the quota hard stop, the public demo key's limits, and the pre-authentication flood throttle (which carries this header alone, because no key has been read yet).
X-Demo-Challenge-Mode僅限示範金鑰
Sent only on responses to the public demo key. The value interactive asks the documentation page to show the visible verification widget - it is sent once a browser has made more than five runs in ten minutes or has received a 429. The page then repeats the header, X-Demo-Challenge-Mode: interactive, on its next request, with the widget's token in X-Demo-Challenge. Requests made with your own key never receive it.

錯誤

詳細資料

Issues a NEW secret and keeps the old one working for 24 hours, so a deploy can roll without an outage. The new secret is returned exactly once.

A key may only rotate ITSELF. The presented key is the authorisation, so {keyId} must be the key making the call - rotating a different key needs a session, at /api/v1/developer/keys. Anything else would let one leaked key rotate every other key on the account.

Distinct from REVOCATION, which is immediate, has no grace window and cannot be undone.

立即試用

正在載入示範金鑰…

curl -X POST "https://api.wambesha.com/v1/account/keys/00000000-0000-0000-0000-000000000000/rotate" \
  -H "Authorization: Bearer YOUR_API_KEY"

範例

{
  "key": {
    "id": "919203ec-bcde-4715-9aac-383351d23f97",
    "name": "cycle17 docs examples",
    "prefix": "wba_test_",
    "lastFour": "125e",
    "environment": "TEST",
    "createdAt": "2026-09-27T16:33:08Z",
    "lastUsedAt": null,
    "expiresAt": null,
    "revokedAt": null,
    "rotatedAt": null,
    "rotationGraceUntil": null,
    "scopes": [],
    "ipAllowlist": [],
    "referrerAllowlist": []
  },
  "secret": "wba_test_0ad12f98dc9bcf5a16fb537b7499125e"
}