# Keys

> The Keys operations of the Hub REST API (1 operation).

URL: https://docs.synap.live/docs/reference/hub-api/keys · Generated from Synap-core/backend@c31e261ab (main)

Paths are relative to `/api/hub` on a pod.

## POST /keys/rotate-cli

Rotate the calling key to the latest CLI scope set

Revokes the current key and issues a new one with the full INTEGRATION_HUB_SCOPES.cli scope set, keeping its expiry. Only an agent/CLI key that already holds hub-protocol.read and hub-protocol.write qualifies; sub-tokens and probe keys are refused.

Responses:

- `200`: New key issued
- `400`: Bad request
- `401`: Unauthorized — no API key auth (session-token callers not supported)
- `403`: This key cannot be rotated to the CLI scope set
- `404`: Not found
- `409`: Conflict — a refusal the caller can act on
- `412`: Precondition failed
- `500`: Internal error