Skip to main content
POST
Rotate every active key of a kind (cutover)

Authorizations

Authorization
string
header
required

Locus Pro dashboard session (Cognito).

Body

application/json
kind
enum<string>
required
Available options:
secret,
publishable,
sandbox
expiresIn
integer | null

Lifetime of the new key in seconds. Omit for the default.

scopes
enum<string>[]

Scopes for the new key. Omit to keep the kind's defaults. Publishable keys accept only widget:read.

Available options:
tenant:read,
tenant:write,
catalog:write,
credits:move,
credentials:manage,
tokens:manage,
payouts:manage,
members:manage,
widget:read
name
string

Name for the replacement key.

Required string length: 1 - 100
tools
object

Endpoint allowlist for the replacement; makes it a burn-only execution credential.

pricing
object
gracePeriodSeconds
integer

Keep the old key valid this long for zero-downtime cutover. Omitted means the old key dies with this response.

Required range: x >= 0

Response

{ success, kind, key, keyPrefix } — the raw key is returned exactly once. Unlike create and per-key rotation, this cutover endpoint returns keyPrefix rather than a keyMetadata object. Without gracePeriodSeconds the superseded keys stop working with this response; with it they keep authenticating until the overlap ends.