Retrieval Results

Preview in your theme

status="ready" — eight chunks for “rotate API keys with zero downtime”. Rank #2 outscores rank #1, so flipping the sort toggle to Score shows exactly where the reranker overruled the embedding. The 0.62 cutoff draws the divider AND the tick on every bar: chunk #6 lost the prompt by 0.008 while being the best answer on the page — the divider button folds those away, it does not delete them. Click a "Used [n]" badge to light up the marker in the answer above.

Create a second API key, roll it out to every worker, and only then revoke the old one1 — the two credentials overlap, so nothing answers 401. Rotate in staging first2, because the gateway caches credentials for up to a minute. You do not have to restart the service as long as the key is read from the environment on every request3.

Retrieved chunks· 8

for “rotate API keys with zero downtime”

8 chunks · 3 used in the answer · 3 below the 0.62 cutoff

pipeline rank #1docs/security/api-keys.md
0.834
Every project can hold two live API keys at the same time. Create the second key, roll it out to your workers, and only then revoke the first one — that overlap is what buys you a zero downtime rotation.
pipeline rank #2runbooks/key-rotation.pdf· p.4
0.881
Step 3 of 7 — rotate the keys in staging first. The gateway caches credentials for up to 60 seconds, so a rotation that revokes the old secret immediately will answer 401 for that window.
pipeline rank #3docs/security/api-keys.mdSent · not cited
0.792
API keys are scoped to a single project and never expire on their own. A leaked key is revoked from Settings → API keys, and the revocation reaches every region within 60 seconds.
pipeline rank #4support/faq-authentication.md
0.723
Do I have to restart the service after I rotate? No — read the credential from the environment on every request instead of once at boot, and the rotation costs zero downtime.
pipeline rank #5changelog/2026-02-14.mdSent · not cited
0.664
Added — keys can now be rotated from the CLI: `zyeon keys rotate --project <id>`. The command prints the new secret exactly once and never again.
pipeline rank #6docs/security/api-keys.md
0.612below cutoff — retrieved but not sent to the model
Grace period: a revoked key keeps answering for five minutes unless you pass --immediate. Teams that cannot pause traffic use the grace period instead of the two-credential overlap.
pipeline rank #7blog/why-we-rotate-secrets.mdx
0.581below cutoff — retrieved but not sent to the model
Secret rotation is a habit, not an incident response. Teams that rotate on a schedule find the sprawl in their public APIs before an attacker finds it for them.
pipeline rank #8legal/dpa-v3.pdf· p.12
0.437below cutoff — retrieved but not sent to the model
12.4 Sub-processors. The processor shall inform the controller of any intended addition or replacement of sub-processors within thirty (30) days, giving the controller the opportunity to object.

terms={["rotate","rotation","rotating","API"]…} — emphasis is whole-word: the query says "keys" and "rotate", so the singular "key" and the noun "rotation" in chunk #1 stay unmarked on the panel above, and "API" would never mark "APIs" either. Feed the retriever's expanded terms through the terms prop and the stems light up here. No threshold is passed, so every chunk reads as included and no divider is drawn.

Retrieved chunks · expanded terms· 3

for “rotate API keys with zero downtime”

3 chunks · 2 used in the answer

pipeline rank #1docs/security/api-keys.mdUsed[1]
0.834
Every project can hold two live API keys at the same time. Create the second key, roll it out to your workers, and only then revoke the first one — that overlap is what buys you a zero downtime rotation.
pipeline rank #2runbooks/key-rotation.pdf· p.4Used[2]
0.881
Step 3 of 7 — rotate the keys in staging first. The gateway caches credentials for up to 60 seconds, so a rotation that revokes the old secret immediately will answer 401 for that window.
pipeline rank #3docs/security/api-keys.mdSent · not cited
0.792
API keys are scoped to a single project and never expire on their own. A leaked key is revoked from Settings → API keys, and the revocation reaches every region within 60 seconds.

Hybrid retrieval: ranks come from reciprocal-rank fusion, the score is the dense leg only — so rank #2 sits at 0.482, under the cutoff. The list is no longer partitioned by the threshold, the divider therefore refuses to draw, and each excluded card carries its own dashed edge and 'below cutoff' mark instead. Ordering here is controlled from outside.

sort = "rank"

Retrieved chunks· 5

for “rotate API keys with zero downtime”

5 chunks · 2 used in the answer · 2 below the 0.62 cutoff

pipeline rank #1docs/security/api-keys.mdUsed[1]
0.834
Every project can hold two live API keys at the same time. Create the second key, roll it out to your workers, and only then revoke the first one — that overlap is what buys you a zero downtime rotation.
pipeline rank #2docs/cli/keys.md
0.482below cutoff — retrieved but not sent to the model
zyeon keys rotate — rotate API keys with zero downtime. Flags: --project, --immediate, --grace <minutes>.
pipeline rank #3runbooks/key-rotation.pdf· p.4Used[2]
0.881
Step 3 of 7 — rotate the keys in staging first. The gateway caches credentials for up to 60 seconds, so a rotation that revokes the old secret immediately will answer 401 for that window.
pipeline rank #4docs/security/api-keys.mdSent · not cited
0.792
API keys are scoped to a single project and never expire on their own. A leaked key is revoked from Settings → API keys, and the revocation reaches every region within 60 seconds.
pipeline rank #5support/faq-authentication.md
0.551below cutoff — retrieved but not sent to the model
Do I have to restart the service after I rotate? No — read the credential from the environment on every request instead of once at boot, and the rotation costs zero downtime.

Every candidate fell under the cutoff. The divider lands at the top and says so, the chunks stay one click away, and nothing on this page pretends the answer was grounded.

Retrieved chunks· 3

for “what is our SOC 2 audit window”

3 chunks · 0 used in the answer · 3 below the 0.62 cutoff

pipeline rank #1docs/security/api-keys.md
0.612below cutoff — retrieved but not sent to the model
Grace period: a revoked key keeps answering for five minutes unless you pass --immediate. Teams that cannot pause traffic use the grace period instead of the two-credential overlap.
pipeline rank #2blog/why-we-rotate-secrets.mdx
0.581below cutoff — retrieved but not sent to the model
Secret rotation is a habit, not an incident response. Teams that rotate on a schedule find the sprawl in their public APIs before an attacker finds it for them.
pipeline rank #3legal/dpa-v3.pdf· p.12
0.437below cutoff — retrieved but not sent to the model
12.4 Sub-processors. The processor shall inform the controller of any intended addition or replacement of sub-processors within thirty (30) days, giving the controller the opportunity to object.

One 861-character chunk against the default 260-character preview. The card states how much text is withheld AND how many query-term matches went with it, so a match hiding past the cut can never masquerade as a chunk that did not match.

Retrieved chunks· 1

for “rotate API keys with zero downtime”

1 chunk · 1 used in the answer · 0 below the 0.62 cutoff

pipeline rank #1docs/security/rotation-policy.md· p.2Used[1]
0.741
Policy 4.2 — credential lifetime. Auxilium atrocitas in magnam. Solus suppellex undique conspergo quis utrum vacuus sit deputo. Clamo clementia maiores cohibeo tui alias volubilis ademptio non spiculum. Tabesco sol utor currus adulatio territo spectaculum aux
Showing 260 of 861 characters · 5 more matches below

A Chinese query and Chinese chunks. 「向量索引」 and 「增量重建」 have no spaces around them, so the word-boundary rule is applied to ASCII terms only — otherwise CJK emphasis would never fire at all.

Retrieved chunks· 3

for “向量索引增量重建停机”

3 chunks · 1 used in the answer · 1 below the 0.6 cutoff

pipeline rank #1手册/检索服务.mdUsed[1]
0.812
增量重建只对新增分片生效:写入新分片时旧的向量索引继续对外提供查询,两份索引在切换窗口内同时在线,因此整个过程不需要停机。
pipeline rank #2手册/检索服务.md· p.3Sent · not cited
0.643
全量重建会锁写:向量索引重算期间新文档进入队列,队列积压超过一万条时写入返回 429,建议放在低峰期执行。
pipeline rank #3手册/计费说明.md
0.408below cutoff — retrieved but not sent to the model
索引存储按 GB·月计费,查询按每千次请求计费,重建产生的写入不额外收费。

status='loading' — the retrieval call is out. The query stays in the header, because a header that still says what was asked is what makes the wait readable.

Retrieved chunks

for “rotate API keys with zero downtime”

status='empty' — the index ran and matched nothing. A different fact from a failed index, and it reads differently.

Retrieved chunks

for “rotate API keys with zero downtime”

The index returned nothing for this query. The answer above, if there is one, is ungrounded.

status='error' — the retrieval step itself failed. The answer above may still exist, ungrounded, so the wording says that and offers a retry.

Retrieved chunks

for “rotate API keys with zero downtime”

Retrieval failed

The vector index timed out after 8s. threshold=0.62 · request-id: 4c1a-77f0

Loading preview…

This component is part of Pro

The install command, prompt and concept map are included with a Pro license — one purchase unlocks every Pro component, forever.

Unlock with Pro