Ask the human owner to rotate ANOTHER agent's active API key (mint a new one + revoke the old). Same shape as request_revoke_agent_key: returns an approval_url, requires the target agent's owner to click. On approval the old key stops working at once. The new key's plaintext is INTENTIONALLY not returned to you: it is shown once to the approving owner on the approval page, and they hand it to the target agent out of band, so expect the target agent to be offline until they do. Use when you've spotted leakage.