> For clean Markdown of any page, append .md to the page URL. > For a complete documentation index, see https://docs.lettbestilt.no/llms.txt. > For AI client integration (Claude Code, Cursor, etc.), connect to the MCP server at https://docs.lettbestilt.no/_mcp/server. # Rotate a restaurant key POST https://www.lettbestilt.no/api/v1/partner/restaurants/{slug}/keys/{keyId}/rotate Content-Type: application/json **Partner key + restaurant key.** Creates a new key first. It gets the same scopes as the old one (not its expiry date) and is shown in plain text **once**, in `restaurantKey.key`, in the same shape as when a restaurant is created. The old key keeps working for `graceHours` (default 24), so you can deploy the new key without downtime. `effectiveAt` is when the old key stops working. Not allowed for an archived restaurant (`409 RESTAURANT_ARCHIVED`). See [Rotating keys without downtime](/rotating-keys). Reference: https://docs.lettbestilt.no/api-reference/partner/rotate-restaurant-key ## Authentication - `Authorization` header (bearer token, required) — The partner key, sent as `Authorization: Bearer lbp_test_…`. Created in the partner portal under **Partner key**. It belongs to the partner, not to a restaurant, and only works against `/api/v1/partner`. Server to server only: a request with an `Origin` header is rejected with `403 FORBIDDEN`. A test key sees and creates only sandboxes; live partner keys are not available yet. A revoked key, a restaurant key (`lbs_…`) here, or a suspended or archived partner returns `401 UNAUTHORIZED`; an expired key returns `401 KEY_EXPIRED`. - `X-LettBestilt-Restaurant-Key` header (required) — The restaurant's own key (`lbs_test_…` or `lbs_live_…`), sent in `X-LettBestilt-Restaurant-Key` together with the partner key for calls about one restaurant. The key must have full access (scope `*`, otherwise `403 INSUFFICIENT_SCOPE`), belong to a restaurant the partner owns, and be in the same environment as the partner key (otherwise `401 UNAUTHORIZED`). A slug that does not exist, belongs to another partner or does not match the key always gives the same `404 RESTAURANT_NOT_FOUND`. Older keys without an environment in the prefix (`lbs_`) are not accepted here; rotate them in the partner portal. ## Request ### Path parameters - `slug` (string, required) — The restaurant's slug. - `keyId` (string, required) — The `id` of the key to replace. ### Body (application/json) This endpoint expects an object. - `name` (string, required) — A name for the new key, 1–80 characters. - `graceHours` (integer, optional, default: 24) — How long the old key keeps working, 0–24 hours. Defaults to 24. - `expiresOn` (date, optional) — Optional expiry date for the new key (`YYYY-MM-DD`), from tomorrow up to two years ahead. The key works through that day, Norwegian time. ## Response ### 201 The new key. Store `restaurantKey.key` now; it is not shown again. - `data` (PartnerRestaurantApiKey, required) — The new key's metadata. - `restaurantKey` (PartnerNewRestaurantKey, required) — A new restaurant key with the plain-text key in `key`, shown once. The same shape on creation and rotation. - `effectiveAt` (datetime, required) — When the old key stops working. - `message` (string, optional) ## Errors ### 400 Bad Request Error `INVALID_JSON`: the body is not valid JSON. - `error` (ErrorBody, required) ### 401 Unauthorized Error `UNAUTHORIZED`: a key is missing, invalid or revoked, the two keys are in different environments, or the partner is suspended or archived. `KEY_EXPIRED`: one of the keys is past its expiry date. - `error` (ErrorBody, required) ### 403 Forbidden Error `FORBIDDEN`: the request has an `Origin` header. `INSUFFICIENT_SCOPE`: the restaurant key does not have full access. - `error` (ErrorBody, required) ### 404 Not Found Error `RESTAURANT_NOT_FOUND`, or `KEY_NOT_FOUND` when the key does not exist or is already revoked. - `error` (ErrorBody, required) ### 409 Conflict Error `RESTAURANT_ARCHIVED`: the restaurant is archived. `CHANGED`: the key changed at the same time; try again. - `error` (ErrorBody, required) ### 422 Unprocessable Entity Error `VALIDATION_FAILED`: `name` is missing, or `graceHours` or `expiresOn` is invalid (`error.details.issues`). - `error` (ErrorBody, required) ### 429 Too Many Requests Error `RATE_LIMITED`: more than 120 calls per minute for this partner key, or more than 30 key and webhook changes per minute for the partner. - `error` (ErrorBody, required) ## Types ### PartnerRestaurantApiKey A restaurant key (`lbs_…`) as the partner sees it. Never the key itself or its hash. - `id` (string, required) — Used to rotate and revoke the key. - `name` (string, required) — The name you gave the key. - `last4` (string, required) — The last four characters of the key. - `environment` (enum, required) - Allowed values: `TEST`, `LIVE` - `scopes` (list of string, required) — `["*"]` is full access. Otherwise the scopes the key is limited to. - `status` (enum, required) — `expiring`: the key expires within 14 days and has not been rotated out. `expired` and `revoked` keys no longer work. A key scheduled for revocation by a rotation stays `active` until then; see `revokedAt`. - Allowed values: `active`, `expiring`, `expired`, `revoked` - `expiresAt` (datetime, required, nullable) — The expiry date, or `null` for no expiry. - `revokedAt` (datetime, required, nullable) — When the key was revoked. A time in the future means it still works until then (rotation with a grace period). - `createdAt` (datetime, required) - `lastUsedAt` (datetime, required, nullable) — Last use, with a resolution of about 5 minutes. ### PartnerNewRestaurantKey A new restaurant key with the plain-text key in `key`, shown once. The same shape on creation and rotation. - `id` (string, required) - `name` (string, required) - `last4` (string, required) - `environment` (enum, required) - Allowed values: `TEST`, `LIVE` - `scopes` (list of string, required) - `key` (string, required) — `lbs_test_…` or `lbs_live_…`. Store it now; it is never shown again. ### ErrorBody - `code` (enum, required) — A machine-readable error code. - Allowed values: `MISSING_SLUG`, `MISSING_TOKEN`, `INVALID_JSON`, `INVALID_SUCCESS_URL`, `INVALID_CANCEL_URL`, `VALIDATION_FAILED`, `RESTAURANT_NOT_FOUND`, `ORDER_NOT_FOUND`, `RATE_LIMITED`, `BAD_REQUEST`, `UNAUTHORIZED`, `FORBIDDEN`, `INSUFFICIENT_SCOPE`, `KEY_EXPIRED`, `POPUP_NOT_AVAILABLE`, `PRICE_CHANGED`, `PAYMENT_INCOMPLETE`, `PAYMENT_PENDING`, `PAYMENT_PROVIDER_INVALID`, `FULFILLMENT_NOT_ALLOWED`, `IDEMPOTENCY_CONFLICT`, `DINE_IN_DISABLED`, `PARTY_TOO_LARGE`, `TOO_EARLY`, `INTERNAL_ERROR`, `PARTNER_AGREEMENT_REQUIRED`, `IDEMPOTENCY_KEY_REQUIRED`, `SLUG_TAKEN`, `SANDBOX_LIMIT`, `RETENTION`, `RESTAURANT_ARCHIVED`, `KEY_NOT_FOUND`, `KEY_IN_USE`, `WEBHOOK_NOT_FOUND`, `WEBHOOK_LIMIT`, `CHANGED` - `message` (string, required) — A human-readable explanation. Often in Norwegian, and for business rules usually suitable to show the customer. - `requestId` (string, required) — The same value as the `X-Request-Id` response header. Search for it in the API log in the partner portal, and include it when you contact LettBestilt. - `details` (any, optional) — Extra data for some codes, for example `issues` for `VALIDATION_FAILED`, the totals for `PRICE_CHANGED` or `requiredScope` for `INSUFFICIENT_SCOPE`. ## Examples **Request** ```json { "name": "Website (October 2026)", "graceHours": 24 } ``` **Response** ```json { "data": { "id": "string", "name": "string", "last4": "string", "environment": "TEST", "scopes": [ "string" ], "status": "active", "expiresAt": "2024-01-15T09:30:00Z", "revokedAt": "2024-01-15T09:30:00Z", "createdAt": "2024-01-15T09:30:00Z", "lastUsedAt": "2024-01-15T09:30:00Z" }, "restaurantKey": { "id": "string", "name": "string", "last4": "string", "environment": "TEST", "scopes": [ "string" ], "key": "string" }, "effectiveAt": "2024-01-15T09:30:00Z", "message": "string" } ``` **SDK Code** ```python Partner_rotateRestaurantKey_example import requests url = "https://www.lettbestilt.no/api/v1/partner/restaurants/slug/keys/keyId/rotate" payload = { "name": "Website (October 2026)", "graceHours": 24 } headers = { "Authorization": "Bearer ", "Content-Type": "application/json" } response = requests.post(url, json=payload, headers=headers) print(response.json()) ``` ```javascript Partner_rotateRestaurantKey_example const url = 'https://www.lettbestilt.no/api/v1/partner/restaurants/slug/keys/keyId/rotate'; const options = { method: 'POST', headers: {Authorization: 'Bearer ', 'Content-Type': 'application/json'}, body: '{"name":"Website (October 2026)","graceHours":24}' }; try { const response = await fetch(url, options); const data = await response.json(); console.log(data); } catch (error) { console.error(error); } ``` ```go Partner_rotateRestaurantKey_example package main import ( "fmt" "strings" "net/http" "io" ) func main() { url := "https://www.lettbestilt.no/api/v1/partner/restaurants/slug/keys/keyId/rotate" payload := strings.NewReader("{\n \"name\": \"Website (October 2026)\",\n \"graceHours\": 24\n}") req, _ := http.NewRequest("POST", url, payload) req.Header.Add("Authorization", "Bearer ") req.Header.Add("Content-Type", "application/json") res, _ := http.DefaultClient.Do(req) defer res.Body.Close() body, _ := io.ReadAll(res.Body) fmt.Println(res) fmt.Println(string(body)) } ``` ```ruby Partner_rotateRestaurantKey_example require 'uri' require 'net/http' url = URI("https://www.lettbestilt.no/api/v1/partner/restaurants/slug/keys/keyId/rotate") http = Net::HTTP.new(url.host, url.port) http.use_ssl = true request = Net::HTTP::Post.new(url) request["Authorization"] = 'Bearer ' request["Content-Type"] = 'application/json' request.body = "{\n \"name\": \"Website (October 2026)\",\n \"graceHours\": 24\n}" response = http.request(request) puts response.read_body ``` ```java Partner_rotateRestaurantKey_example import com.mashape.unirest.http.HttpResponse; import com.mashape.unirest.http.Unirest; HttpResponse response = Unirest.post("https://www.lettbestilt.no/api/v1/partner/restaurants/slug/keys/keyId/rotate") .header("Authorization", "Bearer ") .header("Content-Type", "application/json") .body("{\n \"name\": \"Website (October 2026)\",\n \"graceHours\": 24\n}") .asString(); ``` ```php Partner_rotateRestaurantKey_example request('POST', 'https://www.lettbestilt.no/api/v1/partner/restaurants/slug/keys/keyId/rotate', [ 'body' => '{ "name": "Website (October 2026)", "graceHours": 24 }', 'headers' => [ 'Authorization' => 'Bearer ', 'Content-Type' => 'application/json', ], ]); echo $response->getBody(); ``` ```csharp Partner_rotateRestaurantKey_example using RestSharp; var client = new RestClient("https://www.lettbestilt.no/api/v1/partner/restaurants/slug/keys/keyId/rotate"); var request = new RestRequest(Method.POST); request.AddHeader("Authorization", "Bearer "); request.AddHeader("Content-Type", "application/json"); request.AddParameter("application/json", "{\n \"name\": \"Website (October 2026)\",\n \"graceHours\": 24\n}", ParameterType.RequestBody); IRestResponse response = client.Execute(request); ``` ```swift Partner_rotateRestaurantKey_example import Foundation let headers = [ "Authorization": "Bearer ", "Content-Type": "application/json" ] let parameters = [ "name": "Website (October 2026)", "graceHours": 24 ] as [String : Any] let postData = JSONSerialization.data(withJSONObject: parameters, options: []) let request = NSMutableURLRequest(url: NSURL(string: "https://www.lettbestilt.no/api/v1/partner/restaurants/slug/keys/keyId/rotate")! as URL, cachePolicy: .useProtocolCachePolicy, timeoutInterval: 10.0) request.httpMethod = "POST" request.allHTTPHeaderFields = headers request.httpBody = postData as Data let session = URLSession.shared let dataTask = session.dataTask(with: request as URLRequest, completionHandler: { (data, response, error) -> Void in if (error != nil) { print(error as Any) } else { let httpResponse = response as? HTTPURLResponse print(httpResponse) } }) dataTask.resume() ```