curl --request POST \
--url https://api.enrik.ai/v1/me/rotate \
--header 'Authorization: Bearer <token>' \
--header 'Content-Type: application/json' \
--header 'Idempotency-Key: <idempotency-key>' \
--data '
{
"previousKeyExpiresInSeconds": 3600
}
'import requests
url = "https://api.enrik.ai/v1/me/rotate"
payload = { "previousKeyExpiresInSeconds": 3600 }
headers = {
"Idempotency-Key": "<idempotency-key>",
"Authorization": "Bearer <token>",
"Content-Type": "application/json"
}
response = requests.post(url, json=payload, headers=headers)
print(response.text)const options = {
method: 'POST',
headers: {
'Idempotency-Key': '<idempotency-key>',
Authorization: 'Bearer <token>',
'Content-Type': 'application/json'
},
body: JSON.stringify({previousKeyExpiresInSeconds: 3600})
};
fetch('https://api.enrik.ai/v1/me/rotate', options)
.then(res => res.json())
.then(res => console.log(res))
.catch(err => console.error(err));<?php
$curl = curl_init();
curl_setopt_array($curl, [
CURLOPT_URL => "https://api.enrik.ai/v1/me/rotate",
CURLOPT_RETURNTRANSFER => true,
CURLOPT_ENCODING => "",
CURLOPT_MAXREDIRS => 10,
CURLOPT_TIMEOUT => 30,
CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
CURLOPT_CUSTOMREQUEST => "POST",
CURLOPT_POSTFIELDS => json_encode([
'previousKeyExpiresInSeconds' => 3600
]),
CURLOPT_HTTPHEADER => [
"Authorization: Bearer <token>",
"Content-Type: application/json",
"Idempotency-Key: <idempotency-key>"
],
]);
$response = curl_exec($curl);
$err = curl_error($curl);
curl_close($curl);
if ($err) {
echo "cURL Error #:" . $err;
} else {
echo $response;
}package main
import (
"fmt"
"strings"
"net/http"
"io"
)
func main() {
url := "https://api.enrik.ai/v1/me/rotate"
payload := strings.NewReader("{\n \"previousKeyExpiresInSeconds\": 3600\n}")
req, _ := http.NewRequest("POST", url, payload)
req.Header.Add("Idempotency-Key", "<idempotency-key>")
req.Header.Add("Authorization", "Bearer <token>")
req.Header.Add("Content-Type", "application/json")
res, _ := http.DefaultClient.Do(req)
defer res.Body.Close()
body, _ := io.ReadAll(res.Body)
fmt.Println(string(body))
}HttpResponse<String> response = Unirest.post("https://api.enrik.ai/v1/me/rotate")
.header("Idempotency-Key", "<idempotency-key>")
.header("Authorization", "Bearer <token>")
.header("Content-Type", "application/json")
.body("{\n \"previousKeyExpiresInSeconds\": 3600\n}")
.asString();require 'uri'
require 'net/http'
url = URI("https://api.enrik.ai/v1/me/rotate")
http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true
request = Net::HTTP::Post.new(url)
request["Idempotency-Key"] = '<idempotency-key>'
request["Authorization"] = 'Bearer <token>'
request["Content-Type"] = 'application/json'
request.body = "{\n \"previousKeyExpiresInSeconds\": 3600\n}"
response = http.request(request)
puts response.read_body{
"id": "0199a1b2-0000-7000-8000-00000000a001",
"name": "Nightly sync",
"prefix": "crm_live_Qx8pT2vW",
"scopes": [
"crm:read",
"discovery:read"
],
"createdAt": "2026-10-01T08:00:00.000Z",
"lastUsedAt": "2026-10-09T07:59:12.000Z",
"expiresAt": "2027-01-01T00:00:00.000Z",
"revokedAt": null,
"key": "crm_synthetic_example_not_a_real_token",
"previousKeyExpiresAt": "2026-10-09T09:00:00.000Z"
}{
"error": {
"code": "malformed_json",
"message": "Bad Request",
"requestId": "5b1d3c1e-8d6f-4f2a-9a57-3a9b1f2c7d10"
}
}{
"error": {
"code": "unauthenticated",
"message": "Unauthorized",
"requestId": "5b1d3c1e-8d6f-4f2a-9a57-3a9b1f2c7d10"
}
}{
"error": {
"code": "insufficient_scope",
"message": "Forbidden",
"requestId": "5b1d3c1e-8d6f-4f2a-9a57-3a9b1f2c7d10"
}
}{
"error": {
"code": "conflict",
"message": "Conflict",
"requestId": "5b1d3c1e-8d6f-4f2a-9a57-3a9b1f2c7d10"
}
}{
"error": {
"code": "payload_too_large",
"message": "Payload Too Large",
"requestId": "5b1d3c1e-8d6f-4f2a-9a57-3a9b1f2c7d10"
}
}{
"error": {
"code": "unsupported_media_type",
"message": "Unsupported Media Type",
"requestId": "5b1d3c1e-8d6f-4f2a-9a57-3a9b1f2c7d10"
}
}{
"error": {
"code": "validation_error",
"message": "Unprocessable Entity",
"requestId": "5b1d3c1e-8d6f-4f2a-9a57-3a9b1f2c7d10"
}
}{
"error": {
"code": "rate_limited",
"message": "Too many requests",
"requestId": "5b1d3c1e-8d6f-4f2a-9a57-3a9b1f2c7d10"
}
}{
"error": {
"code": "internal_error",
"message": "Internal Server Error",
"requestId": "5b1d3c1e-8d6f-4f2a-9a57-3a9b1f2c7d10"
}
}{
"error": {
"code": "service_unavailable",
"message": "Service Unavailable",
"requestId": "5b1d3c1e-8d6f-4f2a-9a57-3a9b1f2c7d10"
}
}{
"error": {
"code": "not_found",
"message": "Not found",
"requestId": "5b1d3c1e-8d6f-4f2a-9a57-3a9b1f2c7d10"
}
}Rotate the calling API key
Gives the API key that sent the request a new secret. The key keeps its id, name, scopes and expiry; only the secret changes. The secret that sent the request keeps working until previousKeyExpiresAt (by default one hour, at most 24 hours, 0 for none), so every client can move to the new one, then answers 401. Only the current secret may call it: one a rotation replaced gets 401 here, as a revoked key does, retries included, though it may still revoke the key. Send an Idempotency-Key: a retry with the same key and body, sent with the new secret, answers the same new secret, as long as the key has not rotated again or been revoked. If the answer is lost, rotate the key in Settings → API keys. Any valid API key may call it, whatever its scopes; a browser session gets 401. An owner or admin can still rotate or revoke the key in Settings, which ends both secrets at once.
curl --request POST \
--url https://api.enrik.ai/v1/me/rotate \
--header 'Authorization: Bearer <token>' \
--header 'Content-Type: application/json' \
--header 'Idempotency-Key: <idempotency-key>' \
--data '
{
"previousKeyExpiresInSeconds": 3600
}
'import requests
url = "https://api.enrik.ai/v1/me/rotate"
payload = { "previousKeyExpiresInSeconds": 3600 }
headers = {
"Idempotency-Key": "<idempotency-key>",
"Authorization": "Bearer <token>",
"Content-Type": "application/json"
}
response = requests.post(url, json=payload, headers=headers)
print(response.text)const options = {
method: 'POST',
headers: {
'Idempotency-Key': '<idempotency-key>',
Authorization: 'Bearer <token>',
'Content-Type': 'application/json'
},
body: JSON.stringify({previousKeyExpiresInSeconds: 3600})
};
fetch('https://api.enrik.ai/v1/me/rotate', options)
.then(res => res.json())
.then(res => console.log(res))
.catch(err => console.error(err));<?php
$curl = curl_init();
curl_setopt_array($curl, [
CURLOPT_URL => "https://api.enrik.ai/v1/me/rotate",
CURLOPT_RETURNTRANSFER => true,
CURLOPT_ENCODING => "",
CURLOPT_MAXREDIRS => 10,
CURLOPT_TIMEOUT => 30,
CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
CURLOPT_CUSTOMREQUEST => "POST",
CURLOPT_POSTFIELDS => json_encode([
'previousKeyExpiresInSeconds' => 3600
]),
CURLOPT_HTTPHEADER => [
"Authorization: Bearer <token>",
"Content-Type: application/json",
"Idempotency-Key: <idempotency-key>"
],
]);
$response = curl_exec($curl);
$err = curl_error($curl);
curl_close($curl);
if ($err) {
echo "cURL Error #:" . $err;
} else {
echo $response;
}package main
import (
"fmt"
"strings"
"net/http"
"io"
)
func main() {
url := "https://api.enrik.ai/v1/me/rotate"
payload := strings.NewReader("{\n \"previousKeyExpiresInSeconds\": 3600\n}")
req, _ := http.NewRequest("POST", url, payload)
req.Header.Add("Idempotency-Key", "<idempotency-key>")
req.Header.Add("Authorization", "Bearer <token>")
req.Header.Add("Content-Type", "application/json")
res, _ := http.DefaultClient.Do(req)
defer res.Body.Close()
body, _ := io.ReadAll(res.Body)
fmt.Println(string(body))
}HttpResponse<String> response = Unirest.post("https://api.enrik.ai/v1/me/rotate")
.header("Idempotency-Key", "<idempotency-key>")
.header("Authorization", "Bearer <token>")
.header("Content-Type", "application/json")
.body("{\n \"previousKeyExpiresInSeconds\": 3600\n}")
.asString();require 'uri'
require 'net/http'
url = URI("https://api.enrik.ai/v1/me/rotate")
http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true
request = Net::HTTP::Post.new(url)
request["Idempotency-Key"] = '<idempotency-key>'
request["Authorization"] = 'Bearer <token>'
request["Content-Type"] = 'application/json'
request.body = "{\n \"previousKeyExpiresInSeconds\": 3600\n}"
response = http.request(request)
puts response.read_body{
"id": "0199a1b2-0000-7000-8000-00000000a001",
"name": "Nightly sync",
"prefix": "crm_live_Qx8pT2vW",
"scopes": [
"crm:read",
"discovery:read"
],
"createdAt": "2026-10-01T08:00:00.000Z",
"lastUsedAt": "2026-10-09T07:59:12.000Z",
"expiresAt": "2027-01-01T00:00:00.000Z",
"revokedAt": null,
"key": "crm_synthetic_example_not_a_real_token",
"previousKeyExpiresAt": "2026-10-09T09:00:00.000Z"
}{
"error": {
"code": "malformed_json",
"message": "Bad Request",
"requestId": "5b1d3c1e-8d6f-4f2a-9a57-3a9b1f2c7d10"
}
}{
"error": {
"code": "unauthenticated",
"message": "Unauthorized",
"requestId": "5b1d3c1e-8d6f-4f2a-9a57-3a9b1f2c7d10"
}
}{
"error": {
"code": "insufficient_scope",
"message": "Forbidden",
"requestId": "5b1d3c1e-8d6f-4f2a-9a57-3a9b1f2c7d10"
}
}{
"error": {
"code": "conflict",
"message": "Conflict",
"requestId": "5b1d3c1e-8d6f-4f2a-9a57-3a9b1f2c7d10"
}
}{
"error": {
"code": "payload_too_large",
"message": "Payload Too Large",
"requestId": "5b1d3c1e-8d6f-4f2a-9a57-3a9b1f2c7d10"
}
}{
"error": {
"code": "unsupported_media_type",
"message": "Unsupported Media Type",
"requestId": "5b1d3c1e-8d6f-4f2a-9a57-3a9b1f2c7d10"
}
}{
"error": {
"code": "validation_error",
"message": "Unprocessable Entity",
"requestId": "5b1d3c1e-8d6f-4f2a-9a57-3a9b1f2c7d10"
}
}{
"error": {
"code": "rate_limited",
"message": "Too many requests",
"requestId": "5b1d3c1e-8d6f-4f2a-9a57-3a9b1f2c7d10"
}
}{
"error": {
"code": "internal_error",
"message": "Internal Server Error",
"requestId": "5b1d3c1e-8d6f-4f2a-9a57-3a9b1f2c7d10"
}
}{
"error": {
"code": "service_unavailable",
"message": "Service Unavailable",
"requestId": "5b1d3c1e-8d6f-4f2a-9a57-3a9b1f2c7d10"
}
}{
"error": {
"code": "not_found",
"message": "Not found",
"requestId": "5b1d3c1e-8d6f-4f2a-9a57-3a9b1f2c7d10"
}
}Authorizations
An Enrik API key, sent as Authorization: Bearer <key>. A key reaches public operations only, and only those whose scopes it holds. A few parameters need a scope beyond their operation’s, which the parameter names. The scopes:
setup:read: Read the workspace setup and its company profile.setup:run: Change the setup: confirm the company profile, authorize sponsored drafting and background company research, choose what to set up and complete setup.workspace:read: Read the workspace’s own profile: its health summary and setup state.crm:read: Read companies with their signals, contacts and the saved views over them.crm:write: Create, update and restore companies and contacts, and create, update and delete saved views.crm:delete: Delete companies and contacts.twin:read: Read the Company Twin: structured company knowledge and its signals.discovery:read: Read ICP profiles, ICP assessments, discovery briefs, discovery jobs, candidates and the signal library.discovery:write: Create and change ICP profiles, discovery briefs and signal-definition drafts, and review discovery candidates.discovery:run: Create, start and cancel discovery jobs, and edit a draft one. Uses provider budget.enrichment:read: Read the enrichment configuration and its results, including a record’s enrichment, formula and custom-API cells.enrichment:run: Launch and cancel enrichment. Spends enrichment credits.automation:read: Read workflows and agents with their run history, including a record’s agent cells.automation:run: Run existing workflows and agents.exports:read: Read export jobs and the fields an export can carry.exports:run: Create, preview, start, cancel and archive CSV exports of companies, contacts and candidates, and download the file. Also needscrm:read. Delivering an export to a webhook destination stays in the app.integrations:read: Read connections, field mappings, CRM sync jobs and webhook destinations.webhooks:read: Read webhook subscriptions, the event types they can name and their delivery log.webhooks:write: Subscribe a receiver URL to webhook events; edit, test, pause, resume and archive a subscription and rotate its signing secret; redeliver an event. Only workspace owners and admins can grant it.reporting:read: Read analytics and dashboards.assistant:read: Read the Assistant: its threads, messages and pending approvals.assistant:run: Converse with the Assistant. Uses the workspace’s AI quota.assistant:write: Approve or reject the changes the Assistant proposes.
Headers
A key you choose for this request, such as a UUID. Retrying with the same key returns the first result instead of doing the work twice.
1 - 200Body
How long the replaced secret keeps working. Send {} for the default hour.
How long the secret that sent this request keeps working after the rotation, in seconds: 0 to 86400 (24 hours), 3600 when not sent. 0 ends it at once.
0 <= x <= 86400Response
The rotated key: the same key with a new secret, and when the replaced secret stops working.
The rotated key: the same key with a new secret, and when the replaced secret stops working.
The key’s id, unchanged by the rotation: the apiKeyId GET /v1/me answers.
The label the key was given when it was minted, unchanged.
The first characters of the new secret, as Settings → API keys now shows them.
The scope names the key holds, unchanged by the rotation.
When the key was minted (ISO 8601).
^(?:(?:\d\d[2468][048]|\d\d[13579][26]|\d\d0[48]|[02468][048]00|[13579][26]00)-02-29|\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\d|30)|(?:02)-(?:0[1-9]|1\d|2[0-8])))T(?:(?:[01]\d|2[0-3]):[0-5]\d:[0-5]\d(?:\.\d+)?(?:Z))$When the key last authenticated a request (ISO 8601), or null.
^(?:(?:\d\d[2468][048]|\d\d[13579][26]|\d\d0[48]|[02468][048]00|[13579][26]00)-02-29|\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\d|30)|(?:02)-(?:0[1-9]|1\d|2[0-8])))T(?:(?:[01]\d|2[0-3]):[0-5]\d:[0-5]\d(?:\.\d+)?(?:Z))$When the key stops authenticating (ISO 8601), or null for a key that does not expire. Unchanged by the rotation.
^(?:(?:\d\d[2468][048]|\d\d[13579][26]|\d\d0[48]|[02468][048]00|[13579][26]00)-02-29|\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\d|30)|(?:02)-(?:0[1-9]|1\d|2[0-8])))T(?:(?:[01]\d|2[0-3]):[0-5]\d:[0-5]\d(?:\.\d+)?(?:Z))$Always null here: a revoked key cannot authenticate, so it cannot rotate.
^(?:(?:\d\d[2468][048]|\d\d[13579][26]|\d\d0[48]|[02468][048]00|[13579][26]00)-02-29|\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\d|30)|(?:02)-(?:0[1-9]|1\d|2[0-8])))T(?:(?:[01]\d|2[0-3]):[0-5]\d:[0-5]\d(?:\.\d+)?(?:Z))$The new secret. Store it now: it is shown in this answer and its replay only, never again.
When the secret that sent this request stops working (ISO 8601). Until then both secrets authenticate as this key.
^(?:(?:\d\d[2468][048]|\d\d[13579][26]|\d\d0[48]|[02468][048]00|[13579][26]00)-02-29|\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\d|30)|(?:02)-(?:0[1-9]|1\d|2[0-8])))T(?:(?:[01]\d|2[0-3]):[0-5]\d:[0-5]\d(?:\.\d+)?(?:Z))$Was this page helpful?