Rotate an API key
curl --request POST \
--url https://api.sandbox.rails.wayex.com/v1/api-keys/{id}/rotate \
--header 'Authorization: Bearer <token>' \
--header 'Content-Type: application/json' \
--header 'Idempotency-Key: <idempotency-key>' \
--data '
{
"scopes": [],
"allowedIps": [
"<string>"
]
}
'import requests
url = "https://api.sandbox.rails.wayex.com/v1/api-keys/{id}/rotate"
payload = {
"scopes": [],
"allowedIps": ["<string>"]
}
headers = {
"Idempotency-Key": "<idempotency-key>",
"Authorization": "Bearer <token>",
"Content-Type": "application/json"
}
response = requests.post(url, json=payload, headers=headers)
print(response.text)const options = {
method: 'POST',
headers: {
'Idempotency-Key': '<idempotency-key>',
Authorization: 'Bearer <token>',
'Content-Type': 'application/json'
},
body: JSON.stringify({scopes: [], allowedIps: ['<string>']})
};
fetch('https://api.sandbox.rails.wayex.com/v1/api-keys/{id}/rotate', options)
.then(res => res.json())
.then(res => console.log(res))
.catch(err => console.error(err));<?php
$curl = curl_init();
curl_setopt_array($curl, [
CURLOPT_URL => "https://api.sandbox.rails.wayex.com/v1/api-keys/{id}/rotate",
CURLOPT_RETURNTRANSFER => true,
CURLOPT_ENCODING => "",
CURLOPT_MAXREDIRS => 10,
CURLOPT_TIMEOUT => 30,
CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
CURLOPT_CUSTOMREQUEST => "POST",
CURLOPT_POSTFIELDS => json_encode([
'scopes' => [
],
'allowedIps' => [
'<string>'
]
]),
CURLOPT_HTTPHEADER => [
"Authorization: Bearer <token>",
"Content-Type: application/json",
"Idempotency-Key: <idempotency-key>"
],
]);
$response = curl_exec($curl);
$err = curl_error($curl);
curl_close($curl);
if ($err) {
echo "cURL Error #:" . $err;
} else {
echo $response;
}package main
import (
"fmt"
"strings"
"net/http"
"io"
)
func main() {
url := "https://api.sandbox.rails.wayex.com/v1/api-keys/{id}/rotate"
payload := strings.NewReader("{\n \"scopes\": [],\n \"allowedIps\": [\n \"<string>\"\n ]\n}")
req, _ := http.NewRequest("POST", url, payload)
req.Header.Add("Idempotency-Key", "<idempotency-key>")
req.Header.Add("Authorization", "Bearer <token>")
req.Header.Add("Content-Type", "application/json")
res, _ := http.DefaultClient.Do(req)
defer res.Body.Close()
body, _ := io.ReadAll(res.Body)
fmt.Println(string(body))
}HttpResponse<String> response = Unirest.post("https://api.sandbox.rails.wayex.com/v1/api-keys/{id}/rotate")
.header("Idempotency-Key", "<idempotency-key>")
.header("Authorization", "Bearer <token>")
.header("Content-Type", "application/json")
.body("{\n \"scopes\": [],\n \"allowedIps\": [\n \"<string>\"\n ]\n}")
.asString();require 'uri'
require 'net/http'
url = URI("https://api.sandbox.rails.wayex.com/v1/api-keys/{id}/rotate")
http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true
request = Net::HTTP::Post.new(url)
request["Idempotency-Key"] = '<idempotency-key>'
request["Authorization"] = 'Bearer <token>'
request["Content-Type"] = 'application/json'
request.body = "{\n \"scopes\": [],\n \"allowedIps\": [\n \"<string>\"\n ]\n}"
response = http.request(request)
puts response.read_body{
"id": "<string>",
"counterpartyId": "<string>",
"kind": "secret",
"name": "<string>",
"maskedKey": "<string>",
"lastFour": "<string>",
"status": "active",
"createdAt": "2023-11-07T05:31:56Z",
"secret": "<string>",
"revokedAt": "2023-11-07T05:31:56Z",
"rotatedToId": "<string>",
"scopes": [
"customers:read"
],
"allowedIps": [
"<string>"
]
}Webhooks and account administration
Rotate an API key
Issues a replacement API key that inherits the retiring key’s scopes and IP allow-list. The replacement has a new key ID; the retired key becomes status revoked with rotatedToId pointing at its replacement.
POST
/
v1
/
api-keys
/
{id}
/
rotate
Rotate an API key
curl --request POST \
--url https://api.sandbox.rails.wayex.com/v1/api-keys/{id}/rotate \
--header 'Authorization: Bearer <token>' \
--header 'Content-Type: application/json' \
--header 'Idempotency-Key: <idempotency-key>' \
--data '
{
"scopes": [],
"allowedIps": [
"<string>"
]
}
'import requests
url = "https://api.sandbox.rails.wayex.com/v1/api-keys/{id}/rotate"
payload = {
"scopes": [],
"allowedIps": ["<string>"]
}
headers = {
"Idempotency-Key": "<idempotency-key>",
"Authorization": "Bearer <token>",
"Content-Type": "application/json"
}
response = requests.post(url, json=payload, headers=headers)
print(response.text)const options = {
method: 'POST',
headers: {
'Idempotency-Key': '<idempotency-key>',
Authorization: 'Bearer <token>',
'Content-Type': 'application/json'
},
body: JSON.stringify({scopes: [], allowedIps: ['<string>']})
};
fetch('https://api.sandbox.rails.wayex.com/v1/api-keys/{id}/rotate', options)
.then(res => res.json())
.then(res => console.log(res))
.catch(err => console.error(err));<?php
$curl = curl_init();
curl_setopt_array($curl, [
CURLOPT_URL => "https://api.sandbox.rails.wayex.com/v1/api-keys/{id}/rotate",
CURLOPT_RETURNTRANSFER => true,
CURLOPT_ENCODING => "",
CURLOPT_MAXREDIRS => 10,
CURLOPT_TIMEOUT => 30,
CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
CURLOPT_CUSTOMREQUEST => "POST",
CURLOPT_POSTFIELDS => json_encode([
'scopes' => [
],
'allowedIps' => [
'<string>'
]
]),
CURLOPT_HTTPHEADER => [
"Authorization: Bearer <token>",
"Content-Type: application/json",
"Idempotency-Key: <idempotency-key>"
],
]);
$response = curl_exec($curl);
$err = curl_error($curl);
curl_close($curl);
if ($err) {
echo "cURL Error #:" . $err;
} else {
echo $response;
}package main
import (
"fmt"
"strings"
"net/http"
"io"
)
func main() {
url := "https://api.sandbox.rails.wayex.com/v1/api-keys/{id}/rotate"
payload := strings.NewReader("{\n \"scopes\": [],\n \"allowedIps\": [\n \"<string>\"\n ]\n}")
req, _ := http.NewRequest("POST", url, payload)
req.Header.Add("Idempotency-Key", "<idempotency-key>")
req.Header.Add("Authorization", "Bearer <token>")
req.Header.Add("Content-Type", "application/json")
res, _ := http.DefaultClient.Do(req)
defer res.Body.Close()
body, _ := io.ReadAll(res.Body)
fmt.Println(string(body))
}HttpResponse<String> response = Unirest.post("https://api.sandbox.rails.wayex.com/v1/api-keys/{id}/rotate")
.header("Idempotency-Key", "<idempotency-key>")
.header("Authorization", "Bearer <token>")
.header("Content-Type", "application/json")
.body("{\n \"scopes\": [],\n \"allowedIps\": [\n \"<string>\"\n ]\n}")
.asString();require 'uri'
require 'net/http'
url = URI("https://api.sandbox.rails.wayex.com/v1/api-keys/{id}/rotate")
http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true
request = Net::HTTP::Post.new(url)
request["Idempotency-Key"] = '<idempotency-key>'
request["Authorization"] = 'Bearer <token>'
request["Content-Type"] = 'application/json'
request.body = "{\n \"scopes\": [],\n \"allowedIps\": [\n \"<string>\"\n ]\n}"
response = http.request(request)
puts response.read_body{
"id": "<string>",
"counterpartyId": "<string>",
"kind": "secret",
"name": "<string>",
"maskedKey": "<string>",
"lastFour": "<string>",
"status": "active",
"createdAt": "2023-11-07T05:31:56Z",
"secret": "<string>",
"revokedAt": "2023-11-07T05:31:56Z",
"rotatedToId": "<string>",
"scopes": [
"customers:read"
],
"allowedIps": [
"<string>"
]
}What this endpoint does
Issues a replacement API key that inherits the retiring key’s scopes and IP allow-list. The replacement has a new key ID; the retired key becomes statusrevoked with rotatedToId pointing at its replacement.
When to use it
Rotate routinely and immediately after suspected exposure.Before you call
Manage keys from a console session with a recent second-factor (MFA) confirmation — a request authenticated only with an API key is refused with403 step_up_required — and pass a key ID owned by the same tenant account. Prepare to update the consuming service.
Money and balance effect
This changes a resource or configuration but does not directly reserve, debit, credit, or settle wallet money.States and completion
The new secret is returned once, on this response only. The old secret stops authenticating the moment rotation succeeds — there is no grace period. Update stored key IDs as well as the secret: later update or revoke calls must target the replacement key’s ID.Safe retries
Send a uniqueIdempotency-Key for the logical action. If the response is lost, retry the same payload with the same key; never create a new key merely because the first response timed out.
Read API keys for the complete workflow.Authorizations
BearerApiKey
Send the same Wayex API key as Authorization: Bearer <key>.
Headers
A unique key for this logical action. Reuse the same key and identical payload when retrying after an unknown response.
Required string length:
8 - 255Path Parameters
Body
application/json
Required array length:
1 - 21 elementsAvailable options:
customers:read, customers:write, routes:read, routes:write, transfers:read, transfers:write, treasury:read, treasury:write, rates:read, webhooks:read, webhooks:write, fees:read, fees:write, keys:read, keys:write, settings:read, settings:write, team:read, team:write Required array length:
1 - 50 elementsRequired string length:
1 - 49Pattern:
^[0-9a-fA-F:.]+(\/\d{1,3})?$Response
The replacement key, including the new plaintext secret (shown once).
Minimum string length:
1Minimum string length:
1Available options:
secret, publishable Minimum string length:
1Minimum string length:
1Available options:
active, revoked Minimum string length:
1Minimum string length:
1Available options:
customers:read, customers:write, routes:read, routes:write, transfers:read, transfers:write, treasury:read, treasury:write, rates:read, webhooks:read, webhooks:write, fees:read, fees:write, keys:read, keys:write, settings:read, settings:write, team:read, team:write Required string length:
1 - 49Pattern:
^[0-9a-fA-F:.]+(\/\d{1,3})?$
