Replace an API key with a new secret. The new key value is shown once, in this response.

The key's creator can rotate any key they created. For publishable keys and merchant-pinned secret keys, a user of that merchant, a tenant owner or admin on the merchant's tenant, and Zenoz staff can also rotate them. payout_write and agent_onboarding keys can be rotated only by their creator. Anyone else gets a 404.

The rotated key stays owned by its original creator. The rotation is recorded in the key's audit history with the user who did it.