---
title: "POST /rotated-secret-update-alicloud"
method: POST
path: "/rotated-secret-update-alicloud"
tags: ["Rotated Secrets"]
---

# POST /rotated-secret-update-alicloud

`POST /rotated-secret-update-alicloud`

## Request

- Base URL: `https://api.akeyless.io`
- URL: `https://api.akeyless.io/rotated-secret-update-alicloud`
- Auth: none declared

## Request body

- RotatedSecretUpdateAliCloud
  - `access-key` string: AliCloud RAM user AccessKey secret to rotate (relevant only for rotator-type=access-key)
  - `access-key-id` string: AliCloud RAM user AccessKey ID to rotate (relevant only for rotator-type=access-key). On create with authentication-credentials=use-target-creds it may be empty, then Akeyless creates the AccessKey on the RAM user of the target and manages it
  - `add-tag` string[]: List of the new tags that will be attached to this item
  - `ara-enabled` boolean: Enable or disable Agentic Runtime Authority rule enforcement for this item. When false, user-defined input/output rules are stored but not enforced; the base security validation still runs. AraEnabled is tri-state (nil/true/false), not a plain bool: it self-encodes its wire value (see akl.OptionalBool) so an explicit false survives the curl-proxy relay instead of being dropped like a default-false bool flag.
  - `authentication-credentials` string: The credentials to connect with use-user-creds/use-target-creds
  - `auto-rotate` string
  - `delete_protection` string: Protection from accidental deletion of this object [true/false]
  - `description` string: Description of the object
  - `enable-agentic-runtime-authority` boolean: EnableAra is the documented spelling of AraEnabled. Both set the same field; --ara-enabled shipped first and stays as an undocumented alias so existing scripts and the Terraform provider keep working.
  - `enable-ai-quorum` boolean: Turns on AI Quorum checks for this item.
  - `grace-rotation` string: Enable graceful rotation (keep both versions temporarily). When enabled, a new secret version is created while the previous version is kept for the grace period, so both versions exist for a limited time. [true/false]
  - `grace-rotation-hour` integer: The Hour of the grace rotation in UTC
  - `grace-rotation-interval` string: The number of days to wait before deleting the old key (must be bigger than rotation-interval)
  - `grace-rotation-timing` string: When to create the new version relative to the rotation date [after/before]
  - `input-rule` string[]: Agentic input rule in name=...,rule=... format (e.g. name=rule1,rule=Sanitize input)
  - `item-custom-fields` object: Additional custom fields to associate with the item
  - `json` boolean: Set output format to JSON
  - `keep-prev-version` string: Whether to keep previous version [true/false]. If not set, use default according to account settings
  - `key` string
  - `lock-on-read` string: Lock this secret after each successful value read
  - `lock-ttl` string: Lock TTL in minutes
  - `max-versions` string: Set the maximum number of versions, limited by the account settings defaults.
  - `name` string, required: Rotated secret name
  - `new-name` string: New item name
  - `output-rule` string[]: Agentic output rule in name=...,rule=... format (e.g. name=rule1,rule=Mask secrets)
  - `password-length` string: The length of the password to be generated
  - `rm-tag` string[]: List of the existent tags that will be removed from this item
  - `rotate-on-unlock` string: Rotate this secret after it is unlocked
  - `rotation-event-in` string[]: How many days before the rotation of the item would you like to be notified
  - `rotation-hour` integer
  - `rotation-interval` string
  - `skip-dry-run` boolean: If set, dry-run will be skipped [true/false]
  - `token` string: Authentication token (see `/auth` and `/configure`)
  - `uid-token` string: The universal identity token, Required only for universal_identity authentication
  - `use-capital-letters` string: Specifies whether the generated temporary password must contain at least one uppercase character from the ISO basic Latin alphabet (A to Z). [true/false]
  - `use-lower-letters` string: Specifies whether the generated temporary password must contain at least one lowercase character from the ISO basic Latin alphabet (a to z). [true/false]
  - `use-numbers` string: Specifies whether the generated temporary password must contain at least one numeric character (0 to 9). [true/false]
  - `use-special-characters` string

## Response `201`

rotatedSecretUpdateAliCloudResponse wraps response body.

- RotatedSecretUpdateOutput
  - `name` string

## Other responses

- `default`: errorResponse wraps any error to return it as a JSON object with one "error" field.

## Changes

- **2026-11-03** `4e133adcd48a`: 1 info
  - endpoint added

[Operation history](https://skmtc.dev/akeyless/apis/akeyless-api/changes/rotated-secret-update-alicloud/post.md)

---

[API](https://skmtc.dev/akeyless/apis/akeyless-api.md) - [All operations](https://skmtc.dev/akeyless/apis/akeyless-api/llms.txt) - [OpenAPI document](https://skmtc.dev/akeyless/apis/akeyless-api/revisions/4e133adcd48a?raw)