Roll an API key
curl --request POST \
--url https://api.voucher-staging.allride.io/partner/v1/api-keys/{apiKeyId}:roll \
--header 'Authorization: Bearer <token>' \
--header 'Content-Type: application/json' \
--data '
{
"gracePeriodMinutes": 1440
}
'const options = {
method: 'POST',
headers: {Authorization: 'Bearer <token>', 'Content-Type': 'application/json'},
body: JSON.stringify({gracePeriodMinutes: 1440})
};
fetch('https://api.voucher-staging.allride.io/partner/v1/api-keys/{apiKeyId}:roll', options)
.then(res => res.json())
.then(res => console.log(res))
.catch(err => console.error(err));import requests
url = "https://api.voucher-staging.allride.io/partner/v1/api-keys/{apiKeyId}:roll"
payload = { "gracePeriodMinutes": 1440 }
headers = {
"Authorization": "Bearer <token>",
"Content-Type": "application/json"
}
response = requests.post(url, json=payload, headers=headers)
print(response.text)HttpResponse<String> response = Unirest.post("https://api.voucher-staging.allride.io/partner/v1/api-keys/{apiKeyId}:roll")
.header("Authorization", "Bearer <token>")
.header("Content-Type", "application/json")
.body("{\n \"gracePeriodMinutes\": 1440\n}")
.asString();package main
import (
"fmt"
"strings"
"net/http"
"io"
)
func main() {
url := "https://api.voucher-staging.allride.io/partner/v1/api-keys/{apiKeyId}:roll"
payload := strings.NewReader("{\n \"gracePeriodMinutes\": 1440\n}")
req, _ := http.NewRequest("POST", url, payload)
req.Header.Add("Authorization", "Bearer <token>")
req.Header.Add("Content-Type", "application/json")
res, _ := http.DefaultClient.Do(req)
defer res.Body.Close()
body, _ := io.ReadAll(res.Body)
fmt.Println(string(body))
}<?php
$curl = curl_init();
curl_setopt_array($curl, [
CURLOPT_URL => "https://api.voucher-staging.allride.io/partner/v1/api-keys/{apiKeyId}:roll",
CURLOPT_RETURNTRANSFER => true,
CURLOPT_ENCODING => "",
CURLOPT_MAXREDIRS => 10,
CURLOPT_TIMEOUT => 30,
CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
CURLOPT_CUSTOMREQUEST => "POST",
CURLOPT_POSTFIELDS => json_encode([
'gracePeriodMinutes' => 1440
]),
CURLOPT_HTTPHEADER => [
"Authorization: Bearer <token>",
"Content-Type: application/json"
],
]);
$response = curl_exec($curl);
$err = curl_error($curl);
curl_close($curl);
if ($err) {
echo "cURL Error #:" . $err;
} else {
echo $response;
}{
"data": {
"id": 12018,
"resource": "api-key",
"partnerId": 1069,
"name": "Redemption service (rolled)",
"environment": "test",
"keyHint": "vk_test_01m5h6p2z8c4r7t9vw3x5y6a1b_…Kd2M",
"last4": "Kd2M",
"scopes": [
"view-consumer-catalog",
"create-consumer-redemptions",
"view-consumer-redemptions"
],
"status": "active",
"expiresAt": "2027-11-05T10:00:00Z",
"lastUsedAt": null,
"lastUsedIp": null,
"rolledFromId": 12017,
"createdBy": {
"type": "partner-user",
"id": 4069,
"label": "ops@example.com"
},
"revokedBy": null,
"revokedAt": null,
"secret": "vk_test_01m5h6p2z8c4r7t9vw3x5y6a1b_ExampleSecretDoNotUse1111111111111111111111",
"createdAt": "2026-11-05T10:00:00Z",
"updatedAt": "2026-11-05T10:00:00Z",
"_links": {
"self": {
"href": "https://api.voucher.allride.io/partner/v1/api-keys/12018",
"type": "application/json"
}
}
}
}API keys
Roll an API key
Creates a new key with the same scopes and returns its secret once; the old key keeps working until the grace period ends. Deploy the new secret within the grace period and check its lastUsedAt. The new key shares the old key’s idempotency scope, so retries with the same Idempotency-Key replay instead of executing twice. API keys are managed only in the developer dashboard; API keys cannot call this operation. See API keys.
Required permissions: manage-api-keys · API keys: not allowed · Recent sign-in: required for dashboard users (15 minutes)
POST
/
partner
/
v1
/
api-keys
/
{apiKeyId}
:roll
Roll an API key
curl --request POST \
--url https://api.voucher-staging.allride.io/partner/v1/api-keys/{apiKeyId}:roll \
--header 'Authorization: Bearer <token>' \
--header 'Content-Type: application/json' \
--data '
{
"gracePeriodMinutes": 1440
}
'const options = {
method: 'POST',
headers: {Authorization: 'Bearer <token>', 'Content-Type': 'application/json'},
body: JSON.stringify({gracePeriodMinutes: 1440})
};
fetch('https://api.voucher-staging.allride.io/partner/v1/api-keys/{apiKeyId}:roll', options)
.then(res => res.json())
.then(res => console.log(res))
.catch(err => console.error(err));import requests
url = "https://api.voucher-staging.allride.io/partner/v1/api-keys/{apiKeyId}:roll"
payload = { "gracePeriodMinutes": 1440 }
headers = {
"Authorization": "Bearer <token>",
"Content-Type": "application/json"
}
response = requests.post(url, json=payload, headers=headers)
print(response.text)HttpResponse<String> response = Unirest.post("https://api.voucher-staging.allride.io/partner/v1/api-keys/{apiKeyId}:roll")
.header("Authorization", "Bearer <token>")
.header("Content-Type", "application/json")
.body("{\n \"gracePeriodMinutes\": 1440\n}")
.asString();package main
import (
"fmt"
"strings"
"net/http"
"io"
)
func main() {
url := "https://api.voucher-staging.allride.io/partner/v1/api-keys/{apiKeyId}:roll"
payload := strings.NewReader("{\n \"gracePeriodMinutes\": 1440\n}")
req, _ := http.NewRequest("POST", url, payload)
req.Header.Add("Authorization", "Bearer <token>")
req.Header.Add("Content-Type", "application/json")
res, _ := http.DefaultClient.Do(req)
defer res.Body.Close()
body, _ := io.ReadAll(res.Body)
fmt.Println(string(body))
}<?php
$curl = curl_init();
curl_setopt_array($curl, [
CURLOPT_URL => "https://api.voucher-staging.allride.io/partner/v1/api-keys/{apiKeyId}:roll",
CURLOPT_RETURNTRANSFER => true,
CURLOPT_ENCODING => "",
CURLOPT_MAXREDIRS => 10,
CURLOPT_TIMEOUT => 30,
CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
CURLOPT_CUSTOMREQUEST => "POST",
CURLOPT_POSTFIELDS => json_encode([
'gracePeriodMinutes' => 1440
]),
CURLOPT_HTTPHEADER => [
"Authorization: Bearer <token>",
"Content-Type: application/json"
],
]);
$response = curl_exec($curl);
$err = curl_error($curl);
curl_close($curl);
if ($err) {
echo "cURL Error #:" . $err;
} else {
echo $response;
}{
"data": {
"id": 12018,
"resource": "api-key",
"partnerId": 1069,
"name": "Redemption service (rolled)",
"environment": "test",
"keyHint": "vk_test_01m5h6p2z8c4r7t9vw3x5y6a1b_…Kd2M",
"last4": "Kd2M",
"scopes": [
"view-consumer-catalog",
"create-consumer-redemptions",
"view-consumer-redemptions"
],
"status": "active",
"expiresAt": "2027-11-05T10:00:00Z",
"lastUsedAt": null,
"lastUsedIp": null,
"rolledFromId": 12017,
"createdBy": {
"type": "partner-user",
"id": 4069,
"label": "ops@example.com"
},
"revokedBy": null,
"revokedAt": null,
"secret": "vk_test_01m5h6p2z8c4r7t9vw3x5y6a1b_ExampleSecretDoNotUse1111111111111111111111",
"createdAt": "2026-11-05T10:00:00Z",
"updatedAt": "2026-11-05T10:00:00Z",
"_links": {
"self": {
"href": "https://api.voucher.allride.io/partner/v1/api-keys/12018",
"type": "application/json"
}
}
}
}Dashboard session only. API keys cannot call this operation.
Authorizations
Your API key in Authorization: Bearer <key>. Use vk_test_… keys against the sandbox and vk_live_… keys against production.
Headers
Optional key (1-255 printable ASCII characters, no spaces; a UUID is ideal) that makes this POST safe to retry: the same key with the same request replays the stored response for 24 hours. See Idempotency.
Required string length:
1 - 255Pattern:
^[\x21-\x7E]{1,255}$Path Parameters
API key id. Unsigned 64-bit integer (ids and large counters). May exceed 2^53; parse with a BigInt-safe JSON parser in JavaScript.
Required range:
0 <= x <= 18446744073709552000Body
application/json
Rotation settings.
Minutes both keys keep working (1-10,080, default 1,440).
Required range:
1 <= x <= 10080Response
Created
Single-object envelope around a ApiKeyWithSecret.
A newly created or rolled API key with its secret.
Show child attributes
Show child attributes