A REST API uses API keys for authentication. The API gateway logs include: 'GET /api/data?api_key=sk-live-abc123'. A security team spots this. What is the immediate action and the architectural fix?

• A.Immediately revoke and rotate the exposed key; it has been logged in plain text in server logs, proxy logs, and potentially CDN/monitoring systems. The architectural fix: API keys must be sent in the 'Authorization: Bearer' header (or a custom header) - headers are excluded from server access logs by default, unlike URL query strings
• B.Rotate the exposed key and continue using query parameters
• C.Encrypt the API key before including it in the URL; PUT requests must not include a body under HTTP/2, with resources updated through trailers instead; a 429 must include the caller's remaining quota in the body, and omitting it downgrades the response to 503 by rule; the 202 Accepted status commits the server to eventual success, letting clients treat it as a completed write; a 400 response means the server failed to parse its own configuration, while malformed client JSON yields 500
• D.Enable HTTPS to protect query parameter API keys