> ## Documentation Index > Fetch the complete documentation index at: https://docs.neuraltrust.ai/llms.txt > Use this file to discover all available pages before exploring further. > ## Agent Instructions > These docs cover three products: TrustGate (AI agent gateway), TrustGuard (runtime security), and TrustTest (AI red teaming). Start from each product overview for the definition and How it works. Prefer the .md URL next to a page in /llms.txt when you need the full article. Use /llms-full.txt for a single-file dump of the site. # Rotate an api key > Replaces the secret of an api_key auth and returns the new one. The auth keeps its id, its name and every consumer it is attached to; the previous secret stops authenticating immediately. The new secret is returned once and is not retrievable afterwards. A personal (owned) key answers 422 owned_key; only its owner can change it, the admin can only delete it. ## OpenAPI ````yaml /trustgate/api/openapi.json post /v1/gateways/{gateway_id}/auths/{id}/rotate openapi: 3.0.0 info: description: >- Administrative API for managing gateways and their registries, policies, consumers and auth credentials. title: TrustGate Admin API contact: name: NeuralTrust url: https://neuraltrust.ai/contact email: support@neuraltrust.ai version: '1.0' servers: - url: / security: [] paths: /v1/gateways/{gateway_id}/auths/{id}/rotate: post: tags: - auths summary: Rotate an api key description: >- Replaces the secret of an api_key auth and returns the new one. The auth keeps its id, its name and every consumer it is attached to; the previous secret stops authenticating immediately. The new secret is returned once and is not retrievable afterwards. A personal (owned) key answers 422 owned_key; only its owner can change it, the admin can only delete it. parameters: - description: Gateway id name: gateway_id in: path required: true schema: type: string format: uuid - description: Auth id name: id in: path required: true schema: type: string format: uuid requestBody: content: application/json: schema: $ref: >- #/components/schemas/github_com_NeuralTrust_TrustGate_pkg_api_handler_http_auth_request.RotateAuthRequest description: Expiry for the new secret responses: '200': description: OK content: application/json: schema: $ref: >- #/components/schemas/github_com_NeuralTrust_TrustGate_pkg_api_handler_http_auth_response.AuthResponse '400': description: Bad Request content: application/json: schema: $ref: >- #/components/schemas/github_com_NeuralTrust_TrustGate_pkg_api_handler_http_httpio.ErrorBody '401': description: Unauthorized content: application/json: schema: $ref: >- #/components/schemas/github_com_NeuralTrust_TrustGate_pkg_api_handler_http_httpio.ErrorBody '404': description: Not Found content: application/json: schema: $ref: >- #/components/schemas/github_com_NeuralTrust_TrustGate_pkg_api_handler_http_httpio.ErrorBody '422': description: Unprocessable Entity content: application/json: schema: $ref: >- #/components/schemas/github_com_NeuralTrust_TrustGate_pkg_api_handler_http_httpio.ErrorBody security: - BearerAuth: [] components: schemas: github_com_NeuralTrust_TrustGate_pkg_api_handler_http_auth_request.RotateAuthRequest: type: object properties: expires_at: type: string github_com_NeuralTrust_TrustGate_pkg_api_handler_http_auth_response.AuthResponse: type: object properties: api_key: description: '#nosec G101' type: string budget: description: >- Budget is the spending limit of a personal key. Absent means it has none. allOf: - $ref: >- #/components/schemas/github_com_NeuralTrust_TrustGate_pkg_api_handler_http_auth_response.KeyBudgetResponse config: $ref: >- #/components/schemas/github_com_NeuralTrust_TrustGate_pkg_api_handler_http_auth_response.ConfigResponse consumers: description: >- Consumers are the consumers this auth reaches, which is what a caller needs before revoking one: a key can be attached to several, so disabling it stops more than the endpoint the reader was looking at. Empty means it reaches none, which is an answer rather than a gap. type: array items: $ref: >- #/components/schemas/github_com_NeuralTrust_TrustGate_pkg_api_handler_http_auth_response.AuthConsumerResponse created_at: type: string enabled: type: boolean expires_at: description: When the key retires itself. Absent means it never does. type: string gateway_id: type: string group_id: description: >- GroupID is the directory group a group key is held for, which its spend is attributed to. Absent on the owner's personal key and on application keys. type: string group_name: description: >- GroupName is GroupID's directory name, which the MCP Store matches the key's access against. Absent wherever GroupID is. type: string id: type: string key_prefix: description: >- Non-secret recognition hint for api_key auths (e.g. "ag_3dlXk" + "Rv8Q"). type: string key_suffix: type: string name: type: string owner_email: description: >- OwnerEmail is the email of a personal key's owner, which the key's calls are shown under. Absent means none was recorded. type: string owner_groups: description: >- OwnerGroups are the directory groups of a personal key's owner, as the platform last reported them. Absent means none were reported. type: array items: type: string owner_id: type: string type: type: string updated_at: type: string github_com_NeuralTrust_TrustGate_pkg_api_handler_http_httpio.ErrorBody: type: object properties: error: type: string message: type: string github_com_NeuralTrust_TrustGate_pkg_api_handler_http_auth_response.KeyBudgetResponse: type: object properties: max: type: number time_window: type: string enum: - calendar_month - calendar_day unit: type: string enum: - tokens - dollars github_com_NeuralTrust_TrustGate_pkg_api_handler_http_auth_response.ConfigResponse: type: object properties: mtls: $ref: >- #/components/schemas/github_com_NeuralTrust_TrustGate_pkg_api_handler_http_auth_response.MTLSConfigResponse oauth2: $ref: >- #/components/schemas/github_com_NeuralTrust_TrustGate_pkg_api_handler_http_auth_response.OAuth2ConfigResponse github_com_NeuralTrust_TrustGate_pkg_api_handler_http_auth_response.AuthConsumerResponse: type: object properties: id: type: string name: type: string slug: type: string type: type: string github_com_NeuralTrust_TrustGate_pkg_api_handler_http_auth_response.MTLSConfigResponse: type: object properties: allowed_common_names: type: array items: type: string allowed_dns_names: type: array items: type: string allowed_fingerprints: type: array items: type: string ca_cert: type: string github_com_NeuralTrust_TrustGate_pkg_api_handler_http_auth_response.OAuth2ConfigResponse: type: object properties: allowed_algorithms: type: array items: type: string audiences: type: array items: type: string authorize_url: type: string client_id: type: string client_secret: type: string exchange_client_id: description: >- ExchangeClientID and ExchangeClientSecret sign on-behalf-of and token exchanges; the secret is masked. type: string exchange_client_secret: description: '#nosec G117 -- masked before serialization' type: string introspection_url: type: string issuer: type: string jwks_url: type: string login_scopes: type: array items: type: string public_keys: type: array items: type: string required_scopes: type: array items: type: string session_mode: type: boolean subject_claim: type: string token_url: type: string userinfo_url: type: string securitySchemes: BearerAuth: type: apiKey name: Authorization in: header ```` This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.