Rotate one of this identity's credentials

Rotates the named credential and returns the new secret once. Nothing is stored: the response is the only copy, so a caller that loses it rotates again — the honest failure mode for reveal-once. The old material stops working when this returns.

An api_key keeps its lifetime. Its expiry restarts from the rotation with the credential_ttl_seconds it was created with — a 90-day key rotates into a 90-day key, and an expired key into a live one (a key recorded before lifetimes were kept gets the 90-day default). Both kinds rotate in place at the provider, so a failed rotation leaves the old credential working.

The kind must be one the identity holds; rotating a kind it does not have — or one the provider has no record of — is 404, not a mint. Audited as updated on the credential.

Manageable by the identity's owner or an account admin (organization#clients_manage). A platform identity and an artifact's identity are unreachable by anyone and answer 404; an artifact's credential is managed on its own kind's route. Runs as the calling operator — the caller's bearer is forwarded.