Rotate an API key: revoke + reissue same scope, raw key shown once

curl --request POST \
  --url https://api.feddi.io/v1/partner/auth/keys/{keyId}/regenerate \
  --header 'Content-Type: application/json' \
  --header 'Idempotency-Key: <idempotency-key>' \
  --header 'x-api-key: <api-key>' \
  --data '
{
  "meta": {
    "partner_request_id": "dd04...",
    "occurred_at": "2026-06-05T08:30:00Z",
    "sent_at": "2026-06-05T08:30:00Z",
    "api_version": "2026-06-01"
  },
  "context": {
    "merchant_id": "11111111-1111-1111-1111-111111111111"
  },
  "reason": "scheduled_rotation"
}
'

import requests

url = "https://api.feddi.io/v1/partner/auth/keys/{keyId}/regenerate"

payload = {
    "meta": {
        "partner_request_id": "dd04...",
        "occurred_at": "2026-06-05T08:30:00Z",
        "sent_at": "2026-06-05T08:30:00Z",
        "api_version": "2026-06-01"
    },
    "context": { "merchant_id": "11111111-1111-1111-1111-111111111111" },
    "reason": "scheduled_rotation"
}
headers = {
    "Idempotency-Key": "<idempotency-key>",
    "x-api-key": "<api-key>",
    "Content-Type": "application/json"
}

response = requests.post(url, json=payload, headers=headers)

print(response.text)

const options = {
  method: 'POST',
  headers: {
    'Idempotency-Key': '<idempotency-key>',
    'x-api-key': '<api-key>',
    'Content-Type': 'application/json'
  },
  body: JSON.stringify({
    meta: {
      partner_request_id: 'dd04...',
      occurred_at: '2026-06-05T08:30:00Z',
      sent_at: '2026-06-05T08:30:00Z',
      api_version: '2026-06-01'
    },
    context: {merchant_id: '11111111-1111-1111-1111-111111111111'},
    reason: 'scheduled_rotation'
  })
};

fetch('https://api.feddi.io/v1/partner/auth/keys/{keyId}/regenerate', options)
  .then(res => res.json())
  .then(res => console.log(res))
  .catch(err => console.error(err));

<?php

$curl = curl_init();

curl_setopt_array($curl, [
  CURLOPT_URL => "https://api.feddi.io/v1/partner/auth/keys/{keyId}/regenerate",
  CURLOPT_RETURNTRANSFER => true,
  CURLOPT_ENCODING => "",
  CURLOPT_MAXREDIRS => 10,
  CURLOPT_TIMEOUT => 30,
  CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
  CURLOPT_CUSTOMREQUEST => "POST",
  CURLOPT_POSTFIELDS => json_encode([
    'meta' => [
        'partner_request_id' => 'dd04...',
        'occurred_at' => '2026-06-05T08:30:00Z',
        'sent_at' => '2026-06-05T08:30:00Z',
        'api_version' => '2026-06-01'
    ],
    'context' => [
        'merchant_id' => '11111111-1111-1111-1111-111111111111'
    ],
    'reason' => 'scheduled_rotation'
  ]),
  CURLOPT_HTTPHEADER => [
    "Content-Type: application/json",
    "Idempotency-Key: <idempotency-key>",
    "x-api-key: <api-key>"
  ],
]);

$response = curl_exec($curl);
$err = curl_error($curl);

curl_close($curl);

if ($err) {
  echo "cURL Error #:" . $err;
} else {
  echo $response;
}

package main

import (
	"fmt"
	"strings"
	"net/http"
	"io"
)

func main() {

	url := "https://api.feddi.io/v1/partner/auth/keys/{keyId}/regenerate"

	payload := strings.NewReader("{\n  \"meta\": {\n    \"partner_request_id\": \"dd04...\",\n    \"occurred_at\": \"2026-06-05T08:30:00Z\",\n    \"sent_at\": \"2026-06-05T08:30:00Z\",\n    \"api_version\": \"2026-06-01\"\n  },\n  \"context\": {\n    \"merchant_id\": \"11111111-1111-1111-1111-111111111111\"\n  },\n  \"reason\": \"scheduled_rotation\"\n}")

	req, _ := http.NewRequest("POST", url, payload)

	req.Header.Add("Idempotency-Key", "<idempotency-key>")
	req.Header.Add("x-api-key", "<api-key>")
	req.Header.Add("Content-Type", "application/json")

	res, _ := http.DefaultClient.Do(req)

	defer res.Body.Close()
	body, _ := io.ReadAll(res.Body)

	fmt.Println(string(body))

}

HttpResponse<String> response = Unirest.post("https://api.feddi.io/v1/partner/auth/keys/{keyId}/regenerate")
  .header("Idempotency-Key", "<idempotency-key>")
  .header("x-api-key", "<api-key>")
  .header("Content-Type", "application/json")
  .body("{\n  \"meta\": {\n    \"partner_request_id\": \"dd04...\",\n    \"occurred_at\": \"2026-06-05T08:30:00Z\",\n    \"sent_at\": \"2026-06-05T08:30:00Z\",\n    \"api_version\": \"2026-06-01\"\n  },\n  \"context\": {\n    \"merchant_id\": \"11111111-1111-1111-1111-111111111111\"\n  },\n  \"reason\": \"scheduled_rotation\"\n}")
  .asString();

require 'uri'
require 'net/http'

url = URI("https://api.feddi.io/v1/partner/auth/keys/{keyId}/regenerate")

http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true

request = Net::HTTP::Post.new(url)
request["Idempotency-Key"] = '<idempotency-key>'
request["x-api-key"] = '<api-key>'
request["Content-Type"] = 'application/json'
request.body = "{\n  \"meta\": {\n    \"partner_request_id\": \"dd04...\",\n    \"occurred_at\": \"2026-06-05T08:30:00Z\",\n    \"sent_at\": \"2026-06-05T08:30:00Z\",\n    \"api_version\": \"2026-06-01\"\n  },\n  \"context\": {\n    \"merchant_id\": \"11111111-1111-1111-1111-111111111111\"\n  },\n  \"reason\": \"scheduled_rotation\"\n}"

response = http.request(request)
puts response.read_body

{
  "ok": true,
  "data": {
    "key_id": "ak_02J7Y4",
    "previous_key_id": "ak_01H9X2",
    "raw_key": "fddi_odo_Z9yX1mN7vB4tY6zC0sD5fG8hJ3pQ8r2",
    "key_prefix": "fddi_odo_Z9yX",
    "key_last_four": "8r2",
    "scope": "branch",
    "enterprise_id": "11111111-1111-1111-1111-111111111111",
    "brand_id": "44444444-4444-4444-4444-444444444444",
    "branch_id": "22222222-2222-2222-2222-222222222222",
    "label": "Al-Olaya Branch POS-360-0007",
    "is_sandbox": false,
    "status": "active",
    "created_at": "2026-06-05T08:30:00Z"
  },
  "error": null,
  "meta": {
    "request_id": "req_kg2",
    "idempotency_replayed": false,
    "api_version": "2026-06-01"
  }
}

{
  "ok": true,
  "meta": {
    "request_id": "<string>",
    "api_version": "2026-06-01",
    "idempotency_replayed": true,
    "data_completeness_score": 50,
    "decision_trace_id": "<string>",
    "capabilities": {}
  },
  "data": {},
  "error": {
    "message": "<string>",
    "details": {}
  }
}

{
  "ok": true,
  "meta": {
    "request_id": "<string>",
    "api_version": "2026-06-01",
    "idempotency_replayed": true,
    "data_completeness_score": 50,
    "decision_trace_id": "<string>",
    "capabilities": {}
  },
  "data": {},
  "error": {
    "message": "<string>",
    "details": {}
  }
}

{
  "ok": true,
  "meta": {
    "request_id": "<string>",
    "api_version": "2026-06-01",
    "idempotency_replayed": true,
    "data_completeness_score": 50,
    "decision_trace_id": "<string>",
    "capabilities": {}
  },
  "data": {},
  "error": {
    "message": "<string>",
    "details": {}
  }
}

{
  "ok": true,
  "meta": {
    "request_id": "<string>",
    "api_version": "2026-06-01",
    "idempotency_replayed": true,
    "data_completeness_score": 50,
    "decision_trace_id": "<string>",
    "capabilities": {}
  },
  "data": {},
  "error": {
    "message": "<string>",
    "details": {}
  }
}

auth

Rotate an API key: revoke + reissue same scope, raw key shown once

Zero-downtime rotation: atomically revoke the old key and issue a new raw key, preserving the same scope (enterprise, brand, or branch) and label. After rotation the old raw key fails verification immediately and the new raw key works. The new raw key is returned exactly once in this response, with the same one-time semantics as create. The audit trail records both the old key id (revoked) and the new key id. Note for operators: rotation is immediate with no overlap grace window for in-flight requests still presenting the old key, so sequence the POS terminal swap accordingly. JWTs already minted from the old key remain valid until their own 600-second TTL expires (there is no JWT revocation list, the same window as revoke), so a key-compromise response must assume up to 10 minutes of residual terminal sessions. Idempotent on the Idempotency-Key header: a retried regenerate replays the same new key bytes rather than performing a second rotation. Tenant-scoped: another integration’s key resolves to NOT_FOUND (404). Requires the integrations UPDATE permission.

POST

auth

keys

{keyId}

regenerate

Rotate an API key: revoke + reissue same scope, raw key shown once

curl --request POST \
  --url https://api.feddi.io/v1/partner/auth/keys/{keyId}/regenerate \
  --header 'Content-Type: application/json' \
  --header 'Idempotency-Key: <idempotency-key>' \
  --header 'x-api-key: <api-key>' \
  --data '
{
  "meta": {
    "partner_request_id": "dd04...",
    "occurred_at": "2026-06-05T08:30:00Z",
    "sent_at": "2026-06-05T08:30:00Z",
    "api_version": "2026-06-01"
  },
  "context": {
    "merchant_id": "11111111-1111-1111-1111-111111111111"
  },
  "reason": "scheduled_rotation"
}
'

import requests

url = "https://api.feddi.io/v1/partner/auth/keys/{keyId}/regenerate"

payload = {
    "meta": {
        "partner_request_id": "dd04...",
        "occurred_at": "2026-06-05T08:30:00Z",
        "sent_at": "2026-06-05T08:30:00Z",
        "api_version": "2026-06-01"
    },
    "context": { "merchant_id": "11111111-1111-1111-1111-111111111111" },
    "reason": "scheduled_rotation"
}
headers = {
    "Idempotency-Key": "<idempotency-key>",
    "x-api-key": "<api-key>",
    "Content-Type": "application/json"
}

response = requests.post(url, json=payload, headers=headers)

print(response.text)

const options = {
  method: 'POST',
  headers: {
    'Idempotency-Key': '<idempotency-key>',
    'x-api-key': '<api-key>',
    'Content-Type': 'application/json'
  },
  body: JSON.stringify({
    meta: {
      partner_request_id: 'dd04...',
      occurred_at: '2026-06-05T08:30:00Z',
      sent_at: '2026-06-05T08:30:00Z',
      api_version: '2026-06-01'
    },
    context: {merchant_id: '11111111-1111-1111-1111-111111111111'},
    reason: 'scheduled_rotation'
  })
};

fetch('https://api.feddi.io/v1/partner/auth/keys/{keyId}/regenerate', options)
  .then(res => res.json())
  .then(res => console.log(res))
  .catch(err => console.error(err));

<?php

$curl = curl_init();

curl_setopt_array($curl, [
  CURLOPT_URL => "https://api.feddi.io/v1/partner/auth/keys/{keyId}/regenerate",
  CURLOPT_RETURNTRANSFER => true,
  CURLOPT_ENCODING => "",
  CURLOPT_MAXREDIRS => 10,
  CURLOPT_TIMEOUT => 30,
  CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
  CURLOPT_CUSTOMREQUEST => "POST",
  CURLOPT_POSTFIELDS => json_encode([
    'meta' => [
        'partner_request_id' => 'dd04...',
        'occurred_at' => '2026-06-05T08:30:00Z',
        'sent_at' => '2026-06-05T08:30:00Z',
        'api_version' => '2026-06-01'
    ],
    'context' => [
        'merchant_id' => '11111111-1111-1111-1111-111111111111'
    ],
    'reason' => 'scheduled_rotation'
  ]),
  CURLOPT_HTTPHEADER => [
    "Content-Type: application/json",
    "Idempotency-Key: <idempotency-key>",
    "x-api-key: <api-key>"
  ],
]);

$response = curl_exec($curl);
$err = curl_error($curl);

curl_close($curl);

if ($err) {
  echo "cURL Error #:" . $err;
} else {
  echo $response;
}

package main

import (
	"fmt"
	"strings"
	"net/http"
	"io"
)

func main() {

	url := "https://api.feddi.io/v1/partner/auth/keys/{keyId}/regenerate"

	payload := strings.NewReader("{\n  \"meta\": {\n    \"partner_request_id\": \"dd04...\",\n    \"occurred_at\": \"2026-06-05T08:30:00Z\",\n    \"sent_at\": \"2026-06-05T08:30:00Z\",\n    \"api_version\": \"2026-06-01\"\n  },\n  \"context\": {\n    \"merchant_id\": \"11111111-1111-1111-1111-111111111111\"\n  },\n  \"reason\": \"scheduled_rotation\"\n}")

	req, _ := http.NewRequest("POST", url, payload)

	req.Header.Add("Idempotency-Key", "<idempotency-key>")
	req.Header.Add("x-api-key", "<api-key>")
	req.Header.Add("Content-Type", "application/json")

	res, _ := http.DefaultClient.Do(req)

	defer res.Body.Close()
	body, _ := io.ReadAll(res.Body)

	fmt.Println(string(body))

}

HttpResponse<String> response = Unirest.post("https://api.feddi.io/v1/partner/auth/keys/{keyId}/regenerate")
  .header("Idempotency-Key", "<idempotency-key>")
  .header("x-api-key", "<api-key>")
  .header("Content-Type", "application/json")
  .body("{\n  \"meta\": {\n    \"partner_request_id\": \"dd04...\",\n    \"occurred_at\": \"2026-06-05T08:30:00Z\",\n    \"sent_at\": \"2026-06-05T08:30:00Z\",\n    \"api_version\": \"2026-06-01\"\n  },\n  \"context\": {\n    \"merchant_id\": \"11111111-1111-1111-1111-111111111111\"\n  },\n  \"reason\": \"scheduled_rotation\"\n}")
  .asString();

require 'uri'
require 'net/http'

url = URI("https://api.feddi.io/v1/partner/auth/keys/{keyId}/regenerate")

http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true

request = Net::HTTP::Post.new(url)
request["Idempotency-Key"] = '<idempotency-key>'
request["x-api-key"] = '<api-key>'
request["Content-Type"] = 'application/json'
request.body = "{\n  \"meta\": {\n    \"partner_request_id\": \"dd04...\",\n    \"occurred_at\": \"2026-06-05T08:30:00Z\",\n    \"sent_at\": \"2026-06-05T08:30:00Z\",\n    \"api_version\": \"2026-06-01\"\n  },\n  \"context\": {\n    \"merchant_id\": \"11111111-1111-1111-1111-111111111111\"\n  },\n  \"reason\": \"scheduled_rotation\"\n}"

response = http.request(request)
puts response.read_body

{
  "ok": true,
  "data": {
    "key_id": "ak_02J7Y4",
    "previous_key_id": "ak_01H9X2",
    "raw_key": "fddi_odo_Z9yX1mN7vB4tY6zC0sD5fG8hJ3pQ8r2",
    "key_prefix": "fddi_odo_Z9yX",
    "key_last_four": "8r2",
    "scope": "branch",
    "enterprise_id": "11111111-1111-1111-1111-111111111111",
    "brand_id": "44444444-4444-4444-4444-444444444444",
    "branch_id": "22222222-2222-2222-2222-222222222222",
    "label": "Al-Olaya Branch POS-360-0007",
    "is_sandbox": false,
    "status": "active",
    "created_at": "2026-06-05T08:30:00Z"
  },
  "error": null,
  "meta": {
    "request_id": "req_kg2",
    "idempotency_replayed": false,
    "api_version": "2026-06-01"
  }
}

{
  "ok": true,
  "meta": {
    "request_id": "<string>",
    "api_version": "2026-06-01",
    "idempotency_replayed": true,
    "data_completeness_score": 50,
    "decision_trace_id": "<string>",
    "capabilities": {}
  },
  "data": {},
  "error": {
    "message": "<string>",
    "details": {}
  }
}

{
  "ok": true,
  "meta": {
    "request_id": "<string>",
    "api_version": "2026-06-01",
    "idempotency_replayed": true,
    "data_completeness_score": 50,
    "decision_trace_id": "<string>",
    "capabilities": {}
  },
  "data": {},
  "error": {
    "message": "<string>",
    "details": {}
  }
}

{
  "ok": true,
  "meta": {
    "request_id": "<string>",
    "api_version": "2026-06-01",
    "idempotency_replayed": true,
    "data_completeness_score": 50,
    "decision_trace_id": "<string>",
    "capabilities": {}
  },
  "data": {},
  "error": {
    "message": "<string>",
    "details": {}
  }
}

{
  "ok": true,
  "meta": {
    "request_id": "<string>",
    "api_version": "2026-06-01",
    "idempotency_replayed": true,
    "data_completeness_score": 50,
    "decision_trace_id": "<string>",
    "capabilities": {}
  },
  "data": {},
  "error": {
    "message": "<string>",
    "details": {}
  }
}

Authorizations

x-api-key

string

header

required

Partner API key (platform- or merchant-scoped). Contract key-enforces context.merchant_id.

Headers

Idempotency-Key

string<uuid>

required

Partner-generated UUID; the ONE dedup key for all mutating endpoints. 24h TTL. Same key + same payload -> byte-identical replay; same key + different payload -> IDEMPOTENCY_KEY_REUSED (422).

Path Parameters

keyId

string

required

The API key id to rotate.

Body

application/json

Generic envelope for a no-body key mutation (revoke / regenerate / delete). The canonical envelope plus an optional audit reason.

Response

Rotated. raw_key is the NEW key, present only in this response (or an idempotent replay).

The standard response envelope that every enveloped endpoint serializes through. ok is a boolean discriminator: when ok is true, the typed result is carried in data; when ok is false, a typed error object is returned instead. The meta object is uniform across the entire API surface.

boolean

required

Overview

Endpoints

Rotate an API key: revoke + reissue same scope, raw key shown once

Authorizations

Headers

Path Parameters

Body

Response