# roll

URL: /business/nouns/api-key/roll · Id: `verb:APIKey.roll` · Call: `await $.APIKey.roll({ … })` (SDK) or the `do` tool at `https://api.sb/mcp`. Inputs says what to pass, Outputs what returns, When it waits who approves.

> Roll issues a replacement API Key with the same scope and keeps the old one working until a set time.

Roll issues a replacement [API Key](/business/nouns/api-key) with the same scope and keeps the old one working until a set time.

## Inputs
| Input | Type | Required | Description |
| --- | --- | --- | --- |
| `apiKey` | [API Key](/business/nouns/api-key) | Yes | The API Key to replace. |
| `expireIn` | `string` | No | How long the old key keeps working, from `0h` to `7d`. Defaults to `24h`. |

## Outputs
| Output | Type | Required | Description |
| --- | --- | --- | --- |
| `apiKey` | [API Key](/business/nouns/api-key) | Yes | The replacement API Key. |
| `secret` | `string` | Yes | The replacement’s full secret, returned once. |

## Effects
- Emits [`APIKey.rolled`](/business/events/APIKey.rolled).
- Two-way: it runs at once, in the `try`, `send` and `do` modes.
- Sets the old key’s `expiresAt`; every call it signs after that fails with 401 `unauthorized`.
- Emails the Customer’s admins that the key changed, and when the old one stops.

## Refuses when
| Check | Error | Fix | Then call |
| --- | --- | --- | --- |
| The key is valid, but its scopes do not allow this operation. | [`forbidden`](/code/api/errors/forbidden) | Use a key whose scopes cover the operation, or ask an owner of the namespace to grant them. | [APIKey.roll](/business/nouns/api-key/roll) |

## When it waits
| Gate | Default |
| --- | --- |
| Decision class | Low: two-way, nothing at stake |
| [Delay window](/systems/trust-and-governance/controls/one-way-windows) | None: it runs once review passes. |
| Limit | The call [Limit](/business/nouns/limit) of the [Permission](/business/nouns/permission) it runs under. |
| Over the Limit | It waits `pending` for an [Approval](/business/nouns/approval) from the [Founder](/agents/founding/founder). Approved, it runs; refused, it ends `refused` with [`limit-exceeded`](/code/api/errors/limit-exceeded); unanswered by its deadline, it ends `canceled`. |

## Example

**Ask**

```text
Roll the latest API key.
```

**API**

```bash
curl -X POST https://api.sb/tutorloop.com/api-keys/api_key_1/roll \
  -H "Authorization: Bearer $STARTUP_BUILDER_API_KEY"
```

```json
{
  "api": "https://api.sb/tutorloop.com",
  "apiKey": {
    "$id": "https://api.sb/tutorloop.com/api-keys/api_key_1",
    "$type": "APIKey",
    "name": "Nightly sync",
    "environment": "test"
  },
  "secret": "sk_live_9c1e…",
  "action": {
    "$id": "https://api.sb/tutorloop.com/actions/action_1",
    "operation": "APIKey.roll",
    "status": "done"
  },
  "links": {
    "self": "https://api.sb/tutorloop.com/actions/action_1"
  }
}
```

**SDK**

```ts
import { $ } from 'startup-builder'

const { apiKey, secret } = await $.APIKey.roll({ apiKey: 'api_key_1' })
```

**CLI**

```bash
npx startup-builder do APIKey.roll --json '{"apiKey":"api_key_1"}'
```

**MCP**

```json
{
  "name": "do",
  "arguments": {
    "code": "return await $.APIKey.roll({ apiKey: 'api_key_1' })"
  }
}
```

Guides that call it: [Replace a leaked key](/products/api/replace-a-leaked-key).