Your app uses the primary admin key for index management. If it’s suspected compromised, the least-downtime rotation is:

Regenerate the secondary admin key to ensure it’s known only to you.

Switch the app to use the secondary key (no downtime—primary still works until you cut it off).

Regenerate the primary key to invalidate the compromised credential.

Query keys are read-only and cannot manage indexes, so switching to a query key would not meet the requirement. Regenerating the primary first would break the app until you update it.

References (Microsoft Azure Cognitive Search)

Admin (primary/secondary) vs. query keys and key rotation; key regeneration invalidates only the selected key.

Guidance to use the alternate admin key while rotating the other to avoid downtime.