Rotate the reseller API key secret (secret returned ONCE)

POST 
/admin/keys/:id/rotate

The public part of api_key DOES NOT CHANGE; only the secret is rotated. The old secret becomes invalid IMMEDIATELY (immediate rotate — 24h grace / dual-secret v2 backlog). The APCu auth cache is invalidated. The reseller_id in the body is an ownership guard — another reseller's key returns 404 key_not_found (isolation, no leak).

Request

Responses

200

Secret rotated (plaintext ONCE)

401

X-Admin-Token missing or wrong (unauthorized)

403

Admin API not configured (admin_disabled)

404

No key, revoked/expired, or belongs to another reseller (key_not_found)

422

reseller_id missing/invalid (invalid_input)