---
title: "Issue or rotate an API client secret"
method: POST
path: "/apiops/projects/{projectName}/api-clients/{apiClientKey}/secret-versions"
tags: ["ApiClient"]
---

# Issue or rotate an API client secret

`POST /apiops/projects/{projectName}/api-clients/{apiClientKey}/secret-versions`

## Request

- Base URL: `http://167.86.118.166:32080`
- URL: `http://167.86.118.166:32080/apiops/projects/{projectName}/api-clients/{apiClientKey}/secret-versions`
- Auth: none declared
- TypeScript: <https://skmtc.dev/apinizer/apis/apinizer-management-apis/docs/apiops/projects/:projectName/api-clients/:apiClientKey/secret-versions/post.ts> (a function with typed inputs; its response is checked against the schema)

Adds a secret generation (201 + Location). Requires the Idempotency-Key header and the version query parameter; a GENERATED value is returned once, under no-store, and never again.

## Path parameters

- `projectName` string, required
- `apiClientKey` string, required

## Query parameters

- `version` integer

## Request body

- SecretVersionRequest
  - `materialType` 'LOCAL_SECRET' | 'SECRET_REFERENCE'
  - `generate` boolean
  - `value` string
  - `reference` string
  - `label` string
  - `validFrom` string, date-time
  - `expiresAt` string, date-time
  - `graceWindowSeconds` integer
  - `storageMode` 'ENCRYPTED' | 'HASHED'

## Response `200`

OK

- ApiOpsResponseSecretVersionIssued
  - `apiClient` ApiOpsResponseApiClient
    - `apiClientKey` string
    - `clientId` string
    - `description` string
    - `owner` ApiOpsApiClientOwnerDTO
      - `type` 'CONSUMER' | 'APPLICATION'
      - `key` string
    - `organizationCode` string
    - `operationalState` 'DRAFT' | 'ACTIVE' | 'SUSPENDED' | 'REVOKED'
    - `readiness` 'READY' | 'PENDING_SECRET' | 'UNRESOLVED_DEPENDENCY'
    - `validFrom` string, date-time
    - `expiresAt` string, date-time
    - `allowedGrantTypes` string[]
    - `tokenEndpointAuthMethod` string
    - `redirectUris` string[]
    - `tokenIssuanceProfile` string
    - `tokenNeverExpires` boolean
    - `tokenExpiresInAmount` integer
    - `tokenExpiresInUnit` 'MILLI_SECONDS' | 'SECONDS' | 'MINUTES' | 'HOURS' | 'DAYS' | 'WEEKS' | 'MONTHS' | 'YEARS'
    - `refreshTokenAllowed` boolean
    - `refreshTokenCount` integer
    - `refreshTokenExpiresInAmount` integer
    - `refreshTokenExpiresInUnit` 'MILLI_SECONDS' | 'SECONDS' | 'MINUTES' | 'HOURS' | 'DAYS' | 'WEEKS' | 'MONTHS' | 'YEARS'
    - `jwtSignatureAlgorithm` string
    - `revokedAt` string, date-time
    - `revokedBy` string
    - `revokedReason` string
    - `lifecycleRevision` integer
    - `version` integer
    - `secretVersions` ApiOpsResponseApiClientSecretVersion[]
      - `versionId` string
      - `label` string
      - `status` 'PENDING_ACTIVATION' | 'ACTIVE' | 'GRACE' | 'REVOKED'
      - `materialType` string
      - `storageMode` 'ENCRYPTED' | 'HASHED'
      - `recoveryState` 'AVAILABLE' | 'UNAVAILABLE' | 'SHREDDED'
      - `validFrom` string, date-time
      - `expiresAt` string, date-time
      - `graceUntil` string, date-time
      - `createdAt` string, date-time
      - `revokedAt` string, date-time
      - `revokedReason` string
      - `version` integer
  - `versionId` string
  - `secret` string
  - `runtimeDeployment` ApiOpsRuntimeDeploymentDTO
    - `state` 'IN_SYNC' | 'DEGRADED'
    - `environments` Environment[]
      - `name` string
      - `acknowledged` boolean
      - `detail` string

---

[API](https://skmtc.dev/apinizer/apis/apinizer-management-apis.md) - [All operations](https://skmtc.dev/apinizer/apis/apinizer-management-apis/llms.txt) - [OpenAPI document](https://skmtc.dev/apinizer/apis/apinizer-management-apis/revisions/e083046b24cd?raw)