Regenerate API Key
POST/api/portal/api-keys/:key/regenerate
Replaces the key's secret and returns the new one. The old secret stops working immediately — use this to rotate a key that may have leaked. Name and scopes are kept.
This endpoint currently requires session authentication; Personal Access Token scope support is in progress.
This is the only response that contains the new key (plaintext). For a key with feed:read (including the feed link) csv_url and json_url are included too.
Returns 404 when the key does not exist or belongs to another buyer or account. Viewers get 403 viewer_read_only. Rate limited to 10 requests/minute.
Request
Responses
- 200
- 401
- 403
- 404
- 422
- 429
OK
Response Headers
Unauthenticated — the bearer token is missing, revoked, expired, or malformed. Never retry automatically; fix the credential. See the Errors guide.
Forbidden — the token lacks a required scope, the endpoint is not available to API tokens, or the user behind the token lacks the permission. A human must adjust the token scopes or user permissions; do not retry.
Not Found
Response Headers
Validation failed — the body is a field → messages map (Laravel shape) or the platform envelope with a stable machine-readable code. Fix the payload and resubmit.
Rate limited — platform limit is 1,000 requests/min; individual tokens may carry lower limits. Honor the Retry-After header before retrying. See the Rate Limits guide.