Skip to main content
POST
Rotate the calling API key

Authorizations

Authorization
string
header
required

An Enrik API key, sent as Authorization: Bearer <key>. A key reaches public operations only, and only those whose scopes it holds. A few parameters need a scope beyond their operation’s, which the parameter names. The scopes:

  • setup:read: Read the workspace setup and its company profile.
  • setup:run: Change the setup: confirm the company profile, authorize sponsored drafting and background company research, choose what to set up and complete setup.
  • workspace:read: Read the workspace’s own profile: its health summary and setup state.
  • crm:read: Read companies with their signals, contacts and the saved views over them.
  • crm:write: Create, update and restore companies and contacts, and create, update and delete saved views.
  • crm:delete: Delete companies and contacts.
  • twin:read: Read the Company Twin: structured company knowledge and its signals.
  • discovery:read: Read ICP profiles, ICP assessments, discovery briefs, discovery jobs, candidates and the signal library.
  • discovery:write: Create and change ICP profiles, discovery briefs and signal-definition drafts, and review discovery candidates.
  • discovery:run: Create, start and cancel discovery jobs, and edit a draft one. Uses provider budget.
  • enrichment:read: Read the enrichment configuration and its results, including a record’s enrichment, formula and custom-API cells.
  • enrichment:run: Launch and cancel enrichment. Spends enrichment credits.
  • automation:read: Read workflows and agents with their run history, including a record’s agent cells.
  • automation:run: Run existing workflows and agents.
  • exports:read: Read export jobs and the fields an export can carry.
  • exports:run: Create, preview, start, cancel and archive CSV exports of companies, contacts and candidates, and download the file. Also needs crm:read. Delivering an export to a webhook destination stays in the app.
  • integrations:read: Read connections, field mappings, CRM sync jobs and webhook destinations.
  • webhooks:read: Read webhook subscriptions, the event types they can name and their delivery log.
  • webhooks:write: Subscribe a receiver URL to webhook events; edit, test, pause, resume and archive a subscription and rotate its signing secret; redeliver an event. Only workspace owners and admins can grant it.
  • reporting:read: Read analytics and dashboards.
  • assistant:read: Read the Assistant: its threads, messages and pending approvals.
  • assistant:run: Converse with the Assistant. Uses the workspace’s AI quota.
  • assistant:write: Approve or reject the changes the Assistant proposes.

Headers

Idempotency-Key
string
required

A key you choose for this request, such as a UUID. Retrying with the same key returns the first result instead of doing the work twice.

Required string length: 1 - 200

Body

application/json

How long the replaced secret keeps working. Send {} for the default hour.

previousKeyExpiresInSeconds
integer
default:3600

How long the secret that sent this request keeps working after the rotation, in seconds: 0 to 86400 (24 hours), 3600 when not sent. 0 ends it at once.

Required range: 0 <= x <= 86400

Response

The rotated key: the same key with a new secret, and when the replaced secret stops working.

The rotated key: the same key with a new secret, and when the replaced secret stops working.

id
string
required

The key’s id, unchanged by the rotation: the apiKeyId GET /v1/me answers.

name
string
required

The label the key was given when it was minted, unchanged.

prefix
string
required

The first characters of the new secret, as Settings → API keys now shows them.

scopes
string[]
required

The scope names the key holds, unchanged by the rotation.

createdAt
string<date-time>
required

When the key was minted (ISO 8601).

Pattern: ^(?:(?:\d\d[2468][048]|\d\d[13579][26]|\d\d0[48]|[02468][048]00|[13579][26]00)-02-29|\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\d|30)|(?:02)-(?:0[1-9]|1\d|2[0-8])))T(?:(?:[01]\d|2[0-3]):[0-5]\d:[0-5]\d(?:\.\d+)?(?:Z))$
lastUsedAt
string<date-time> | null
required

When the key last authenticated a request (ISO 8601), or null.

Pattern: ^(?:(?:\d\d[2468][048]|\d\d[13579][26]|\d\d0[48]|[02468][048]00|[13579][26]00)-02-29|\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\d|30)|(?:02)-(?:0[1-9]|1\d|2[0-8])))T(?:(?:[01]\d|2[0-3]):[0-5]\d:[0-5]\d(?:\.\d+)?(?:Z))$
expiresAt
string<date-time> | null
required

When the key stops authenticating (ISO 8601), or null for a key that does not expire. Unchanged by the rotation.

Pattern: ^(?:(?:\d\d[2468][048]|\d\d[13579][26]|\d\d0[48]|[02468][048]00|[13579][26]00)-02-29|\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\d|30)|(?:02)-(?:0[1-9]|1\d|2[0-8])))T(?:(?:[01]\d|2[0-3]):[0-5]\d:[0-5]\d(?:\.\d+)?(?:Z))$
revokedAt
string<date-time> | null
required

Always null here: a revoked key cannot authenticate, so it cannot rotate.

Pattern: ^(?:(?:\d\d[2468][048]|\d\d[13579][26]|\d\d0[48]|[02468][048]00|[13579][26]00)-02-29|\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\d|30)|(?:02)-(?:0[1-9]|1\d|2[0-8])))T(?:(?:[01]\d|2[0-3]):[0-5]\d:[0-5]\d(?:\.\d+)?(?:Z))$
key
string
required

The new secret. Store it now: it is shown in this answer and its replay only, never again.

previousKeyExpiresAt
string<date-time>
required

When the secret that sent this request stops working (ISO 8601). Until then both secrets authenticate as this key.

Pattern: ^(?:(?:\d\d[2468][048]|\d\d[13579][26]|\d\d0[48]|[02468][048]00|[13579][26]00)-02-29|\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\d|30)|(?:02)-(?:0[1-9]|1\d|2[0-8])))T(?:(?:[01]\d|2[0-3]):[0-5]\d:[0-5]\d(?:\.\d+)?(?:Z))$