Cloud IAM Re-enable and Re-scope a Disabled API Key
A 4-step recipe with IBM. We can help you get access.
Recipe · 4 steps
Cloud IAM Re-enable and Re-scope a Disabled API Key
with IBM · Identity & Access Management
Re-enable a disabled API key and update its expiry using optimistic concurrency control.
- Read the key and confirm it is actually disabled before enabling anything. This prevents the workflow from silently acting on the wrong key id.
- Re-enable the key so it can authenticate again. This is the step that restores access, and it is deliberately separate from the metadata update.
- Re-read the key to pick up a fresh entity tag. Enabling the key changed the resource version, so the tag captured before the enable would be stale and the following update would be rejected with a conflict.
- Bound the revived key with a new expiry and record why it was restored. The If-Match header carries the freshly read entity tag so a competing edit fails with a 409 rather than being clobbered.
What you'll need to have ready
- apiKeyId: The unique identifier of the disabled API key to bring back into service.
- expiresAt: The new expiration date and time for the key, bounding how long it stays valid.
- updatedDescription: A description recording the review that cleared the key for re-enablement.
- actionWhenLeaked: The action IBM Cloud should take if this key is detected as leaked.
For your developer
Arazzo workflow ibm:reactivate-api-key, 4 operations: getApiKey → enableApiKey → getApiKey → updateApiKey. Specs on APIs.io.