A valid request URL is required to generate request examples{
"environment_id": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
"kid": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
"grace_hours": 123
}{
"error": {
"code": "forbidden",
"message": "your role does not allow this action"
}
}{
"error": {
"code": "forbidden",
"message": "your role does not allow this action"
}
}{
"error": {
"code": "forbidden",
"message": "your role does not allow this action"
}
}{
"error": {
"code": "forbidden",
"message": "your role does not allow this action"
}
}Rotate the signing key
Requires api_keys:write — the same gate as the identity secret, because this key mints the tokens a developer’s backend trusts.
The old key stops signing immediately and keeps verifying for a 24-hour grace window: the overlap that lets JWKS caches refresh and in-flight JWTs expire. For a suspected compromise the same arithmetic runs in reverse — every token signed with the old key is dead within its 5-minute lifetime of the rotation, which is the bound to quote.
A valid request URL is required to generate request examples{
"environment_id": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
"kid": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
"grace_hours": 123
}{
"error": {
"code": "forbidden",
"message": "your role does not allow this action"
}
}{
"error": {
"code": "forbidden",
"message": "your role does not allow this action"
}
}{
"error": {
"code": "forbidden",
"message": "your role does not allow this action"
}
}{
"error": {
"code": "forbidden",
"message": "your role does not allow this action"
}
}Autorizações
A staff session token, uk_st_…. Minted by sign-up, sign-in or the two-factor exchange. Only a 401 means it is spent; not_a_member (403) is about the organization named in X-Organization-Id and leaves the token good for the others.
Cabeçalhos
The organization the caller is acting on — the org_… code that appears in the panel URL. It identifies; the membership JOIN is what authorizes, so a forged code reads nothing: the answer is not_a_member (403), which does not mean the session is over. Absent, the session's default organization answers, or — if that membership was revoked while the session was open — any other one the caller still holds.
Parâmetros de caminho
The environment's id.