Secrets

Server-side secret rotation

Generates a cryptographically random value and stores it as a new version of the secret. The previous version is preserved in history. Requires rotate or write permission.

post/v1/vaults/{vault_id}/secret-rotate/{path}

Request

  • Base URL: https://api.1claw.co
  • URL: https://api.1claw.co/v1/vaults/{vault_id}/secret-rotate/{path}
  • Auth: HTTP bearer

Path parameters

vault_idstring uuid required
pathstring required

Secret path (e.g. "db/credentials")

Request body

lengthinteger

Length of the generated value (default 32)

charset'hex' | 'base64' | 'alphanumeric' | 'ascii'

Character set for the generated value (default hex)

typestring

Override the secret type (defaults to existing secret's type)

Response

New version created with server-generated value

idstring uuid required
pathstring required
typestring required
versioninteger required
metadataobject
created_atstring date-time required
expires_atstring date-time
client_sharestring

Base64-encoded client key share. Returned only for MPC 2-of-2 vaults. The client must store this share securely — it is not persisted server-side.

Changes

No recorded changes to this operation across all 2 revisions of this API.