Roll an API key
curl --request POST \
--url https://api.voucher-staging.allride.io/partner/v1/api-keys/{apiKeyId}:roll \
--header 'Authorization: Bearer <token>' \
--header 'Content-Type: application/json' \
--data '
{
"gracePeriodMinutes": 1440
}
'const options = {
method: 'POST',
headers: {Authorization: 'Bearer <token>', 'Content-Type': 'application/json'},
body: JSON.stringify({gracePeriodMinutes: 1440})
};
fetch('https://api.voucher-staging.allride.io/partner/v1/api-keys/{apiKeyId}:roll', options)
.then(res => res.json())
.then(res => console.log(res))
.catch(err => console.error(err));import requests
url = "https://api.voucher-staging.allride.io/partner/v1/api-keys/{apiKeyId}:roll"
payload = { "gracePeriodMinutes": 1440 }
headers = {
"Authorization": "Bearer <token>",
"Content-Type": "application/json"
}
response = requests.post(url, json=payload, headers=headers)
print(response.text)HttpResponse<String> response = Unirest.post("https://api.voucher-staging.allride.io/partner/v1/api-keys/{apiKeyId}:roll")
.header("Authorization", "Bearer <token>")
.header("Content-Type", "application/json")
.body("{\n \"gracePeriodMinutes\": 1440\n}")
.asString();package main
import (
"fmt"
"strings"
"net/http"
"io"
)
func main() {
url := "https://api.voucher-staging.allride.io/partner/v1/api-keys/{apiKeyId}:roll"
payload := strings.NewReader("{\n \"gracePeriodMinutes\": 1440\n}")
req, _ := http.NewRequest("POST", url, payload)
req.Header.Add("Authorization", "Bearer <token>")
req.Header.Add("Content-Type", "application/json")
res, _ := http.DefaultClient.Do(req)
defer res.Body.Close()
body, _ := io.ReadAll(res.Body)
fmt.Println(string(body))
}<?php
$curl = curl_init();
curl_setopt_array($curl, [
CURLOPT_URL => "https://api.voucher-staging.allride.io/partner/v1/api-keys/{apiKeyId}:roll",
CURLOPT_RETURNTRANSFER => true,
CURLOPT_ENCODING => "",
CURLOPT_MAXREDIRS => 10,
CURLOPT_TIMEOUT => 30,
CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
CURLOPT_CUSTOMREQUEST => "POST",
CURLOPT_POSTFIELDS => json_encode([
'gracePeriodMinutes' => 1440
]),
CURLOPT_HTTPHEADER => [
"Authorization: Bearer <token>",
"Content-Type: application/json"
],
]);
$response = curl_exec($curl);
$err = curl_error($curl);
curl_close($curl);
if ($err) {
echo "cURL Error #:" . $err;
} else {
echo $response;
}{
"data": {
"id": 12017,
"resource": "api-key",
"partnerId": 42,
"name": "Inventory sync",
"environment": "test",
"keyHint": "vk_test_<keyId>_…Qa7Z",
"last4": "Qa7Z",
"scopes": [
"view-profile",
"view-provider-voucher-sets",
"upload-provider-vouchers"
],
"status": "active",
"expiresAt": "2027-10-22T10:00:00Z",
"lastUsedAt": null,
"lastUsedIp": null,
"rolledFromId": null,
"createdBy": {
"type": "partner-user",
"id": 4043,
"label": "ops@example.com"
},
"revokedBy": null,
"revokedAt": null,
"createdAt": "2026-10-22T10:00:00Z",
"updatedAt": "2026-10-22T10:00:00Z",
"_links": {
"self": {
"href": "https://api.voucher-staging.allride.io/partner/v1/api-keys/12017",
"type": "application/json"
}
},
"secret": "vk_test_<keyId>_<43 characters, shown once>"
}
}API keys
Roll an API key
Creates a new key with the same scopes and lets the old key expire after gracePeriodMinutes (default 1,440). Both keys work during the grace period, and the new key shares the old key’s idempotency scope, so retries replay. The new secret is shown once.
Dashboard users need a sign-in within the last 15 minutes (reauthentication-required); API keys are exempt. The response carries a show-once value; an idempotent replay returns it as null with Idempotent-Replay-Redacted: true.
Required permissions: manage-api-keys · API keys: not allowed
POST
/
partner
/
v1
/
api-keys
/
{apiKeyId}
:roll
Roll an API key
curl --request POST \
--url https://api.voucher-staging.allride.io/partner/v1/api-keys/{apiKeyId}:roll \
--header 'Authorization: Bearer <token>' \
--header 'Content-Type: application/json' \
--data '
{
"gracePeriodMinutes": 1440
}
'const options = {
method: 'POST',
headers: {Authorization: 'Bearer <token>', 'Content-Type': 'application/json'},
body: JSON.stringify({gracePeriodMinutes: 1440})
};
fetch('https://api.voucher-staging.allride.io/partner/v1/api-keys/{apiKeyId}:roll', options)
.then(res => res.json())
.then(res => console.log(res))
.catch(err => console.error(err));import requests
url = "https://api.voucher-staging.allride.io/partner/v1/api-keys/{apiKeyId}:roll"
payload = { "gracePeriodMinutes": 1440 }
headers = {
"Authorization": "Bearer <token>",
"Content-Type": "application/json"
}
response = requests.post(url, json=payload, headers=headers)
print(response.text)HttpResponse<String> response = Unirest.post("https://api.voucher-staging.allride.io/partner/v1/api-keys/{apiKeyId}:roll")
.header("Authorization", "Bearer <token>")
.header("Content-Type", "application/json")
.body("{\n \"gracePeriodMinutes\": 1440\n}")
.asString();package main
import (
"fmt"
"strings"
"net/http"
"io"
)
func main() {
url := "https://api.voucher-staging.allride.io/partner/v1/api-keys/{apiKeyId}:roll"
payload := strings.NewReader("{\n \"gracePeriodMinutes\": 1440\n}")
req, _ := http.NewRequest("POST", url, payload)
req.Header.Add("Authorization", "Bearer <token>")
req.Header.Add("Content-Type", "application/json")
res, _ := http.DefaultClient.Do(req)
defer res.Body.Close()
body, _ := io.ReadAll(res.Body)
fmt.Println(string(body))
}<?php
$curl = curl_init();
curl_setopt_array($curl, [
CURLOPT_URL => "https://api.voucher-staging.allride.io/partner/v1/api-keys/{apiKeyId}:roll",
CURLOPT_RETURNTRANSFER => true,
CURLOPT_ENCODING => "",
CURLOPT_MAXREDIRS => 10,
CURLOPT_TIMEOUT => 30,
CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
CURLOPT_CUSTOMREQUEST => "POST",
CURLOPT_POSTFIELDS => json_encode([
'gracePeriodMinutes' => 1440
]),
CURLOPT_HTTPHEADER => [
"Authorization: Bearer <token>",
"Content-Type: application/json"
],
]);
$response = curl_exec($curl);
$err = curl_error($curl);
curl_close($curl);
if ($err) {
echo "cURL Error #:" . $err;
} else {
echo $response;
}{
"data": {
"id": 12017,
"resource": "api-key",
"partnerId": 42,
"name": "Inventory sync",
"environment": "test",
"keyHint": "vk_test_<keyId>_…Qa7Z",
"last4": "Qa7Z",
"scopes": [
"view-profile",
"view-provider-voucher-sets",
"upload-provider-vouchers"
],
"status": "active",
"expiresAt": "2027-10-22T10:00:00Z",
"lastUsedAt": null,
"lastUsedIp": null,
"rolledFromId": null,
"createdBy": {
"type": "partner-user",
"id": 4043,
"label": "ops@example.com"
},
"revokedBy": null,
"revokedAt": null,
"createdAt": "2026-10-22T10:00:00Z",
"updatedAt": "2026-10-22T10:00:00Z",
"_links": {
"self": {
"href": "https://api.voucher-staging.allride.io/partner/v1/api-keys/12017",
"type": "application/json"
}
},
"secret": "vk_test_<keyId>_<43 characters, shown once>"
}
}Dashboard session only. API keys cannot call this operation.
Authorizations
ID token of a signed-in dashboard user. Operations that API keys cannot call use it.
Headers
Optional on every POST: 1-255 printable ASCII characters without spaces (a UUID is recommended). The same key with the same request replays the stored response for 24 hours. See Idempotency.
Required string length:
1 - 255Pattern:
^[\x21-\x7E]{1,255}$Path Parameters
Numeric id (apiKeyId). A non-numeric id is a 400 data-failed-validation; an unknown id or one of another partner is a 404. Unsigned 64-bit integer. May exceed 2^53; parse with a BigInt-safe JSON parser in JavaScript.
Required range:
0 <= x <= 18446744073709552000Body
application/json
Roll an API key.
1-10,080; default 1,440.
Required range:
1 <= x <= 10080Response
Success.
Single-object envelope around ApiKeyWithSecret.
An API key with its secret, returned only by create and :roll.
Show child attributes
Show child attributes