kernel 0.67.0__tar.gz → 0.68.0__tar.gz

kernel-0.68.0/.release-please-manifest.json

@@ -0,0 +1,3 @@
+{
+  ".": "0.68.0"
+}

{kernel-0.67.0 → kernel-0.68.0}/CHANGELOG.md

@@ -1,5 +1,31 @@
 # Changelog
 
+## 0.68.0 (2026-06-15)
+
+Full Changelog: [v0.67.0...v0.68.0](https://github.com/kernel/kernel-python-sdk/compare/v0.67.0...v0.68.0)
+
+### Features
+
+* Add API key rotate endpoint ([e383f7d](https://github.com/kernel/kernel-python-sdk/commit/e383f7d4b6af4f2921200d4a0f6922e730f58e08))
+* **api:** surface deleted/expired API keys for audit trail (KERNEL-1350) ([55e32db](https://github.com/kernel/kernel-python-sdk/commit/55e32dbaf07275c63623a31ec6df88c6aa128f8f))
+
+
+### Bug Fixes
+
+* **pagination:** correct type:ignore placement; stop on 0 sentinel ([5d2afd7](https://github.com/kernel/kernel-python-sdk/commit/5d2afd7df0f2d21d754ca936286ac3a92762e9db))
+* **pagination:** fail loudly on contradictory headers; test both classes ([4554697](https://github.com/kernel/kernel-python-sdk/commit/4554697a9d850848b602a2422199fb2ce72d8efc))
+* **pagination:** stop skipping a page per auto-pagination iteration ([c0a3e14](https://github.com/kernel/kernel-python-sdk/commit/c0a3e14b51e39dfdba37bacf023b2f98d4a3be69))
+
+
+### Styles
+
+* ruff import-sort and format the pagination test ([843fade](https://github.com/kernel/kernel-python-sdk/commit/843fadeb07fb7cebd5d2689eb78511bb8ee0d293))
+
+
+### Refactors
+
+* **api:** align API key audit surface with browser sibling (KERNEL-1350) ([12868d1](https://github.com/kernel/kernel-python-sdk/commit/12868d18dbb081c0e998299b799ac693dd878d0f))
+
 ## 0.67.0 (2026-06-11)
 
 Full Changelog: [v0.66.0...v0.67.0](https://github.com/kernel/kernel-python-sdk/compare/v0.66.0...v0.67.0)

{kernel-0.67.0 → kernel-0.68.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.3
 Name: kernel
-Version: 0.67.0
+Version: 0.68.0
 Summary: The official Python library for the kernel API
 Project-URL: Homepage, https://github.com/kernel/kernel-python-sdk
 Project-URL: Repository, https://github.com/kernel/kernel-python-sdk
@@ -220,8 +220,8 @@ first_page = await client.deployments.list(
 )
 
 print(
-    f"the current start offset for this page: {first_page.next_offset}"
-)  # => "the current start offset for this page: 1"
+    f"the offset where the next page starts: {first_page.next_offset}"
+)  # => "the offset where the next page starts: 2"
 for deployment in first_page.items:
     print(deployment.id)
 

{kernel-0.67.0 → kernel-0.68.0}/README.md

@@ -185,8 +185,8 @@ first_page = await client.deployments.list(
 )
 
 print(
-    f"the current start offset for this page: {first_page.next_offset}"
-)  # => "the current start offset for this page: 1"
+    f"the offset where the next page starts: {first_page.next_offset}"
+)  # => "the offset where the next page starts: 2"
 for deployment in first_page.items:
     print(deployment.id)
 

{kernel-0.67.0 → kernel-0.68.0}/api.md

@@ -449,10 +449,11 @@ from kernel.types import APIKey, CreatedAPIKey
 Methods:
 
 - <code title="post /org/api_keys">client.api_keys.<a href="./src/kernel/resources/api_keys.py">create</a>(\*\*<a href="src/kernel/types/api_key_create_params.py">params</a>) -> <a href="./src/kernel/types/created_api_key.py">CreatedAPIKey</a></code>
-- <code title="get /org/api_keys/{id}">client.api_keys.<a href="./src/kernel/resources/api_keys.py">retrieve</a>(id) -> <a href="./src/kernel/types/api_key.py">APIKey</a></code>
+- <code title="get /org/api_keys/{id}">client.api_keys.<a href="./src/kernel/resources/api_keys.py">retrieve</a>(id, \*\*<a href="src/kernel/types/api_key_retrieve_params.py">params</a>) -> <a href="./src/kernel/types/api_key.py">APIKey</a></code>
 - <code title="patch /org/api_keys/{id}">client.api_keys.<a href="./src/kernel/resources/api_keys.py">update</a>(id, \*\*<a href="src/kernel/types/api_key_update_params.py">params</a>) -> <a href="./src/kernel/types/api_key.py">APIKey</a></code>
 - <code title="get /org/api_keys">client.api_keys.<a href="./src/kernel/resources/api_keys.py">list</a>(\*\*<a href="src/kernel/types/api_key_list_params.py">params</a>) -> <a href="./src/kernel/types/api_key.py">SyncOffsetPagination[APIKey]</a></code>
 - <code title="delete /org/api_keys/{id}">client.api_keys.<a href="./src/kernel/resources/api_keys.py">delete</a>(id) -> None</code>
+- <code title="post /org/api_keys/{id}/rotate">client.api_keys.<a href="./src/kernel/resources/api_keys.py">rotate</a>(id, \*\*<a href="src/kernel/types/api_key_rotate_params.py">params</a>) -> <a href="./src/kernel/types/created_api_key.py">CreatedAPIKey</a></code>
 
 # CredentialProviders
 

{kernel-0.67.0 → kernel-0.68.0}/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "kernel"
-version = "0.67.0"
+version = "0.68.0"
 description = "The official Python library for the kernel API"
 dynamic = ["readme"]
 license = "Apache-2.0"

{kernel-0.67.0 → kernel-0.68.0}/src/kernel/_version.py

@@ -1,4 +1,4 @@
 # File generated from our OpenAPI spec by Stainless. See CONTRIBUTING.md for details.
 
 __title__ = "kernel"
-__version__ = "0.67.0"  # x-release-please-version
+__version__ = "0.68.0"  # x-release-please-version

{kernel-0.67.0 → kernel-0.68.0}/src/kernel/pagination.py

@@ -40,12 +40,20 @@ class SyncOffsetPagination(BaseSyncPage[_T], BasePage[_T], Generic[_T]):
     def next_page_info(self) -> Optional[PageInfo]:
         next_offset = self.next_offset
         if next_offset is None:
-            return None  # type: ignore[unreachable]
+            if self.has_more:  # type: ignore[unreachable]
+                raise RuntimeError(
+                    "Server reported X-Has-More: true without an X-Next-Offset header; "
+                    "refusing to silently truncate pagination"
+                )
+            return None
 
-        length = len(self._get_page_items())
-        current_count = next_offset + length
+        # X-Next-Offset is the next page's absolute start, or 0 on the last page
+        # (the API's stop sentinel). Only a positive offset advances; the old code
+        # added the current page length on top, skipping a page per iteration.
+        if next_offset == 0:
+            return None
 
-        return PageInfo(params={"offset": current_count})
+        return PageInfo(params={"offset": next_offset})
 
     @classmethod
     def build(cls: Type[_BaseModelT], *, response: Response, data: object) -> _BaseModelT:  # noqa: ARG003
@@ -83,12 +91,20 @@ class AsyncOffsetPagination(BaseAsyncPage[_T], BasePage[_T], Generic[_T]):
     def next_page_info(self) -> Optional[PageInfo]:
         next_offset = self.next_offset
         if next_offset is None:
-            return None  # type: ignore[unreachable]
-
-        length = len(self._get_page_items())
-        current_count = next_offset + length
-
-        return PageInfo(params={"offset": current_count})
+            if self.has_more:  # type: ignore[unreachable]
+                raise RuntimeError(
+                    "Server reported X-Has-More: true without an X-Next-Offset header; "
+                    "refusing to silently truncate pagination"
+                )
+            return None
+
+        # X-Next-Offset is the next page's absolute start, or 0 on the last page
+        # (the API's stop sentinel). Only a positive offset advances; the old code
+        # added the current page length on top, skipping a page per iteration.
+        if next_offset == 0:
+            return None
+
+        return PageInfo(params={"offset": next_offset})
 
     @classmethod
     def build(cls: Type[_BaseModelT], *, response: Response, data: object) -> _BaseModelT:  # noqa: ARG003

{kernel-0.67.0 → kernel-0.68.0}/src/kernel/resources/api_keys.py

@@ -7,7 +7,13 @@ from typing_extensions import Literal
 
 import httpx
 
-from ..types import api_key_list_params, api_key_create_params, api_key_update_params
+from ..types import (
+    api_key_list_params,
+    api_key_create_params,
+    api_key_rotate_params,
+    api_key_update_params,
+    api_key_retrieve_params,
+)
 from .._types import Body, Omit, Query, Headers, NoneType, NotGiven, omit, not_given
 from .._utils import path_template, maybe_transform, async_maybe_transform
 from .._compat import cached_property
@@ -99,6 +105,7 @@ class APIKeysResource(SyncAPIResource):
         self,
         id: str,
         *,
+        include_deleted: bool | Omit = omit,
         # Use the following arguments if you need to pass additional parameters to the API that aren't available via kwargs.
         # The extra values given here take precedence over values defined on the client or passed to this method.
         extra_headers: Headers | None = None,
@@ -112,6 +119,9 @@ class APIKeysResource(SyncAPIResource):
         masked.
 
         Args:
+          include_deleted: When true, return the API key even if it has been deleted (soft-deleted), for
+              audit purposes. Defaults to false, which returns 404 for a deleted key.
+
           extra_headers: Send extra headers
 
           extra_query: Add additional query parameters to the request
@@ -125,7 +135,13 @@ class APIKeysResource(SyncAPIResource):
         return self._get(
             path_template("/org/api_keys/{id}", id=id),
             options=make_request_options(
-                extra_headers=extra_headers, extra_query=extra_query, extra_body=extra_body, timeout=timeout
+                extra_headers=extra_headers,
+                extra_query=extra_query,
+                extra_body=extra_body,
+                timeout=timeout,
+                query=maybe_transform(
+                    {"include_deleted": include_deleted}, api_key_retrieve_params.APIKeyRetrieveParams
+                ),
             ),
             cast_to=APIKey,
         )
@@ -170,11 +186,13 @@ class APIKeysResource(SyncAPIResource):
     def list(
         self,
         *,
+        include_deleted: bool | Omit = omit,
         limit: int | Omit = omit,
         offset: int | Omit = omit,
         query: str | Omit = omit,
         sort_by: Literal["created_at", "name", "expires_at"] | Omit = omit,
         sort_direction: Literal["asc", "desc"] | Omit = omit,
+        status: Literal["active", "deleted", "all"] | Omit = omit,
         # Use the following arguments if you need to pass additional parameters to the API that aren't available via kwargs.
         # The extra values given here take precedence over values defined on the client or passed to this method.
         extra_headers: Headers | None = None,
@@ -187,6 +205,9 @@ class APIKeysResource(SyncAPIResource):
         API keys are masked.
 
         Args:
+          include_deleted: Deprecated: use status=all instead. When true, include deleted (soft-deleted)
+              API keys in the results for audit purposes.
+
           limit: Maximum number of results to return
 
           offset: Number of results to skip
@@ -198,6 +219,10 @@ class APIKeysResource(SyncAPIResource):
 
           sort_direction: Sort direction for API keys.
 
+          status: Filter API keys by status. "active" returns keys that are not deleted (default;
+              expired-but-not-deleted keys are still included), "deleted" returns only
+              soft-deleted keys, "all" returns both.
+
           extra_headers: Send extra headers
 
           extra_query: Add additional query parameters to the request
@@ -216,11 +241,13 @@ class APIKeysResource(SyncAPIResource):
                 timeout=timeout,
                 query=maybe_transform(
                     {
+                        "include_deleted": include_deleted,
                         "limit": limit,
                         "offset": offset,
                         "query": query,
                         "sort_by": sort_by,
                         "sort_direction": sort_direction,
+                        "status": status,
                     },
                     api_key_list_params.APIKeyListParams,
                 ),
@@ -262,6 +289,57 @@ class APIKeysResource(SyncAPIResource):
             cast_to=NoneType,
         )
 
+    def rotate(
+        self,
+        id: str,
+        *,
+        days_to_expire: Optional[int] | Omit = omit,
+        expire_in_days: Optional[int] | Omit = omit,
+        # Use the following arguments if you need to pass additional parameters to the API that aren't available via kwargs.
+        # The extra values given here take precedence over values defined on the client or passed to this method.
+        extra_headers: Headers | None = None,
+        extra_query: Query | None = None,
+        extra_body: Body | None = None,
+        timeout: float | httpx.Timeout | None | NotGiven = not_given,
+    ) -> CreatedAPIKey:
+        """Rotate an API key.
+
+        Issues a new key that copies the name and project of the
+        rotated key, and schedules the rotated key to expire after a grace period so
+        in-flight callers can swap over. The new plaintext key is returned once.
+
+        Args:
+          days_to_expire: Lifetime in days for the new key, up to 3650. Omit to reuse the rotated key's
+              original lifetime, or never-expires if it had none.
+
+          expire_in_days: Grace period in days before the rotated key expires. Use 0 to expire it
+              immediately. Omit for the default grace period of 7 days.
+
+          extra_headers: Send extra headers
+
+          extra_query: Add additional query parameters to the request
+
+          extra_body: Add additional JSON properties to the request
+
+          timeout: Override the client-level default timeout for this request, in seconds
+        """
+        if not id:
+            raise ValueError(f"Expected a non-empty value for `id` but received {id!r}")
+        return self._post(
+            path_template("/org/api_keys/{id}/rotate", id=id),
+            body=maybe_transform(
+                {
+                    "days_to_expire": days_to_expire,
+                    "expire_in_days": expire_in_days,
+                },
+                api_key_rotate_params.APIKeyRotateParams,
+            ),
+            options=make_request_options(
+                extra_headers=extra_headers, extra_query=extra_query, extra_body=extra_body, timeout=timeout
+            ),
+            cast_to=CreatedAPIKey,
+        )
+
 
 class AsyncAPIKeysResource(AsyncAPIResource):
     """Create and manage API keys for organization and project-scoped access."""
@@ -336,6 +414,7 @@ class AsyncAPIKeysResource(AsyncAPIResource):
         self,
         id: str,
         *,
+        include_deleted: bool | Omit = omit,
         # Use the following arguments if you need to pass additional parameters to the API that aren't available via kwargs.
         # The extra values given here take precedence over values defined on the client or passed to this method.
         extra_headers: Headers | None = None,
@@ -349,6 +428,9 @@ class AsyncAPIKeysResource(AsyncAPIResource):
         masked.
 
         Args:
+          include_deleted: When true, return the API key even if it has been deleted (soft-deleted), for
+              audit purposes. Defaults to false, which returns 404 for a deleted key.
+
           extra_headers: Send extra headers
 
           extra_query: Add additional query parameters to the request
@@ -362,7 +444,13 @@ class AsyncAPIKeysResource(AsyncAPIResource):
         return await self._get(
             path_template("/org/api_keys/{id}", id=id),
             options=make_request_options(
-                extra_headers=extra_headers, extra_query=extra_query, extra_body=extra_body, timeout=timeout
+                extra_headers=extra_headers,
+                extra_query=extra_query,
+                extra_body=extra_body,
+                timeout=timeout,
+                query=await async_maybe_transform(
+                    {"include_deleted": include_deleted}, api_key_retrieve_params.APIKeyRetrieveParams
+                ),
             ),
             cast_to=APIKey,
         )
@@ -407,11 +495,13 @@ class AsyncAPIKeysResource(AsyncAPIResource):
     def list(
         self,
         *,
+        include_deleted: bool | Omit = omit,
         limit: int | Omit = omit,
         offset: int | Omit = omit,
         query: str | Omit = omit,
         sort_by: Literal["created_at", "name", "expires_at"] | Omit = omit,
         sort_direction: Literal["asc", "desc"] | Omit = omit,
+        status: Literal["active", "deleted", "all"] | Omit = omit,
         # Use the following arguments if you need to pass additional parameters to the API that aren't available via kwargs.
         # The extra values given here take precedence over values defined on the client or passed to this method.
         extra_headers: Headers | None = None,
@@ -424,6 +514,9 @@ class AsyncAPIKeysResource(AsyncAPIResource):
         API keys are masked.
 
         Args:
+          include_deleted: Deprecated: use status=all instead. When true, include deleted (soft-deleted)
+              API keys in the results for audit purposes.
+
           limit: Maximum number of results to return
 
           offset: Number of results to skip
@@ -435,6 +528,10 @@ class AsyncAPIKeysResource(AsyncAPIResource):
 
           sort_direction: Sort direction for API keys.
 
+          status: Filter API keys by status. "active" returns keys that are not deleted (default;
+              expired-but-not-deleted keys are still included), "deleted" returns only
+              soft-deleted keys, "all" returns both.
+
           extra_headers: Send extra headers
 
           extra_query: Add additional query parameters to the request
@@ -453,11 +550,13 @@ class AsyncAPIKeysResource(AsyncAPIResource):
                 timeout=timeout,
                 query=maybe_transform(
                     {
+                        "include_deleted": include_deleted,
                         "limit": limit,
                         "offset": offset,
                         "query": query,
                         "sort_by": sort_by,
                         "sort_direction": sort_direction,
+                        "status": status,
                     },
                     api_key_list_params.APIKeyListParams,
                 ),
@@ -499,6 +598,57 @@ class AsyncAPIKeysResource(AsyncAPIResource):
             cast_to=NoneType,
         )
 
+    async def rotate(
+        self,
+        id: str,
+        *,
+        days_to_expire: Optional[int] | Omit = omit,
+        expire_in_days: Optional[int] | Omit = omit,
+        # Use the following arguments if you need to pass additional parameters to the API that aren't available via kwargs.
+        # The extra values given here take precedence over values defined on the client or passed to this method.
+        extra_headers: Headers | None = None,
+        extra_query: Query | None = None,
+        extra_body: Body | None = None,
+        timeout: float | httpx.Timeout | None | NotGiven = not_given,
+    ) -> CreatedAPIKey:
+        """Rotate an API key.
+
+        Issues a new key that copies the name and project of the
+        rotated key, and schedules the rotated key to expire after a grace period so
+        in-flight callers can swap over. The new plaintext key is returned once.
+
+        Args:
+          days_to_expire: Lifetime in days for the new key, up to 3650. Omit to reuse the rotated key's
+              original lifetime, or never-expires if it had none.
+
+          expire_in_days: Grace period in days before the rotated key expires. Use 0 to expire it
+              immediately. Omit for the default grace period of 7 days.
+
+          extra_headers: Send extra headers
+
+          extra_query: Add additional query parameters to the request
+
+          extra_body: Add additional JSON properties to the request
+
+          timeout: Override the client-level default timeout for this request, in seconds
+        """
+        if not id:
+            raise ValueError(f"Expected a non-empty value for `id` but received {id!r}")
+        return await self._post(
+            path_template("/org/api_keys/{id}/rotate", id=id),
+            body=await async_maybe_transform(
+                {
+                    "days_to_expire": days_to_expire,
+                    "expire_in_days": expire_in_days,
+                },
+                api_key_rotate_params.APIKeyRotateParams,
+            ),
+            options=make_request_options(
+                extra_headers=extra_headers, extra_query=extra_query, extra_body=extra_body, timeout=timeout
+            ),
+            cast_to=CreatedAPIKey,
+        )
+
 
 class APIKeysResourceWithRawResponse:
     def __init__(self, api_keys: APIKeysResource) -> None:
@@ -519,6 +669,9 @@ class APIKeysResourceWithRawResponse:
         self.delete = to_raw_response_wrapper(
             api_keys.delete,
         )
+        self.rotate = to_raw_response_wrapper(
+            api_keys.rotate,
+        )
 
 
 class AsyncAPIKeysResourceWithRawResponse:
@@ -540,6 +693,9 @@ class AsyncAPIKeysResourceWithRawResponse:
         self.delete = async_to_raw_response_wrapper(
             api_keys.delete,
         )
+        self.rotate = async_to_raw_response_wrapper(
+            api_keys.rotate,
+        )
 
 
 class APIKeysResourceWithStreamingResponse:
@@ -561,6 +717,9 @@ class APIKeysResourceWithStreamingResponse:
         self.delete = to_streamed_response_wrapper(
             api_keys.delete,
         )
+        self.rotate = to_streamed_response_wrapper(
+            api_keys.rotate,
+        )
 
 
 class AsyncAPIKeysResourceWithStreamingResponse:
@@ -582,3 +741,6 @@ class AsyncAPIKeysResourceWithStreamingResponse:
         self.delete = async_to_streamed_response_wrapper(
             api_keys.delete,
         )
+        self.rotate = async_to_streamed_response_wrapper(
+            api_keys.rotate,
+        )

{kernel-0.67.0 → kernel-0.68.0}/src/kernel/types/__init__.py

@@ -39,6 +39,7 @@ from .proxy_create_params import ProxyCreateParams as ProxyCreateParams
 from .proxy_list_response import ProxyListResponse as ProxyListResponse
 from .proxy_check_response import ProxyCheckResponse as ProxyCheckResponse
 from .api_key_create_params import APIKeyCreateParams as APIKeyCreateParams
+from .api_key_rotate_params import APIKeyRotateParams as APIKeyRotateParams
 from .api_key_update_params import APIKeyUpdateParams as APIKeyUpdateParams
 from .browser_create_params import BrowserCreateParams as BrowserCreateParams
 from .browser_curl_response import BrowserCurlResponse as BrowserCurlResponse
@@ -54,6 +55,7 @@ from .deployment_list_params import DeploymentListParams as DeploymentListParams
 from .deployment_state_event import DeploymentStateEvent as DeploymentStateEvent
 from .invocation_list_params import InvocationListParams as InvocationListParams
 from .invocation_state_event import InvocationStateEvent as InvocationStateEvent
+from .api_key_retrieve_params import APIKeyRetrieveParams as APIKeyRetrieveParams
 from .browser_create_response import BrowserCreateResponse as BrowserCreateResponse
 from .browser_retrieve_params import BrowserRetrieveParams as BrowserRetrieveParams
 from .browser_update_response import BrowserUpdateResponse as BrowserUpdateResponse

{kernel-0.67.0 → kernel-0.68.0}/src/kernel/types/api_key.py

@@ -28,6 +28,12 @@ class APIKey(BaseModel):
 
     created_by: CreatedBy
 
+    deleted_at: Optional[datetime] = None
+    """When the API key was deleted (soft-deleted).
+
+    Null for keys that have not been deleted.
+    """
+
     expires_at: Optional[datetime] = None
     """When the API key expires"""
 

{kernel-0.67.0 → kernel-0.68.0}/src/kernel/types/api_key_list_params.py

@@ -8,6 +8,13 @@ __all__ = ["APIKeyListParams"]
 
 
 class APIKeyListParams(TypedDict, total=False):
+    include_deleted: bool
+    """Deprecated: use status=all instead.
+
+    When true, include deleted (soft-deleted) API keys in the results for audit
+    purposes.
+    """
+
     limit: int
     """Maximum number of results to return"""
 
@@ -25,3 +32,11 @@ class APIKeyListParams(TypedDict, total=False):
 
     sort_direction: Literal["asc", "desc"]
     """Sort direction for API keys."""
+
+    status: Literal["active", "deleted", "all"]
+    """Filter API keys by status.
+
+    "active" returns keys that are not deleted (default; expired-but-not-deleted
+    keys are still included), "deleted" returns only soft-deleted keys, "all"
+    returns both.
+    """

kernel-0.68.0/src/kernel/types/api_key_retrieve_params.py

@@ -0,0 +1,15 @@
+# File generated from our OpenAPI spec by Stainless. See CONTRIBUTING.md for details.
+
+from __future__ import annotations
+
+from typing_extensions import TypedDict
+
+__all__ = ["APIKeyRetrieveParams"]
+
+
+class APIKeyRetrieveParams(TypedDict, total=False):
+    include_deleted: bool
+    """
+    When true, return the API key even if it has been deleted (soft-deleted), for
+    audit purposes. Defaults to false, which returns 404 for a deleted key.
+    """

kernel-0.68.0/src/kernel/types/api_key_rotate_params.py

@@ -0,0 +1,23 @@
+# File generated from our OpenAPI spec by Stainless. See CONTRIBUTING.md for details.
+
+from __future__ import annotations
+
+from typing import Optional
+from typing_extensions import TypedDict
+
+__all__ = ["APIKeyRotateParams"]
+
+
+class APIKeyRotateParams(TypedDict, total=False):
+    days_to_expire: Optional[int]
+    """Lifetime in days for the new key, up to 3650.
+
+    Omit to reuse the rotated key's original lifetime, or never-expires if it had
+    none.
+    """
+
+    expire_in_days: Optional[int]
+    """Grace period in days before the rotated key expires.
+
+    Use 0 to expire it immediately. Omit for the default grace period of 7 days.
+    """