Issues a new secret for the ServiceAccount API key that authenticates this request; the old secret is invalidated immediately. Only ServiceAccount API keys may call it; sessions, including sessions minted by a ServiceAccount, are refused with 403. No scope is required. Idempotency-Key is required. The new secret is returned once. If the response is lost, retrying cannot recover it, because the old secret no longer authenticates: another authorized administrator (a Person admin, or a ServiceAccount that manages this ServiceAccount's keys) must rotate the key. There is no automatic recovery. When two rotations of the same key race, one succeeds and the other fails with 409.