---
title: "Rotate a registration trunk's SIP password"
method: POST
path: "/api/v1/trunks/{id}/rotate-credentials"
tags: ["SIP Trunks"]
---

# Rotate a registration trunk's SIP password

`POST /api/v1/trunks/{id}/rotate-credentials`

## Request

- Base URL: `https://api.callnode.io`
- URL: `https://api.callnode.io/api/v1/trunks/{id}/rotate-credentials`
- Auth: API key in header `X-Api-Key` and API key in header `X-Timestamp` and API key in header `X-Signature`

Generates a new SIP password for a registration trunk, keeping the same
username. This is the only recovery path for a lost password: CallNode
stores a non-reversible digest, never the plaintext.

The new password is returned **once**, in `sipPassword`. The previous
password stops working within about a minute, so update your PBX
promptly — it will need to re-register.

## Response `200`

New credentials. `sipPassword` appears only in this response.

- SipTrunk: A saved SIP trunk — egress (outbound BYOC), ingress (inbound from your PBX/SBC), or both.
  - `id` string
  - `name` string: 1–64 characters. Unique across your active trunks.
  - `status` 'active' | 'disabled'
  - `egressEnabled` boolean: Whether outbound (BYOC) delivery to `egressHost` is enabled.
  - `egressHost` string, nullable: Hostname or IP of your SIP endpoint for outbound delivery. Null for an ingress-only trunk.
  - `egressPort` integer
  - `egressTransport` 'udp' | 'tcp' | 'tls'
  - `ingressEnabled` boolean: Whether inbound calls from `allowedIps` are accepted.
  - `allowedIps` string[]: Public IPv4 addresses your PBX/SBC sends from — the accepted ingress source IPs.
  - `defaultPhoneNumberId` string, nullable: The id of one of your numbers — the default agent for ingress calls that do not match one of your own DIDs.
  - `outboundCliNumberId` string, nullable: The id of one of your numbers, presented as caller ID on outbound (termination) calls when the INVITE's From is not itself one of your numbers — the normal case for a registration trunk, whose From carries its auth username. A From that IS one of your live numbers always wins, so a multi-number PBX can still present per-call caller ID.
  - `monthlyFeeApplies` boolean: True when this trunk is beyond your plan's included count and is billed the additional-trunk fee.
  - `nextBillingDate` string, date-time, nullable
  - `registration` object: Registration-trunk settings, for a PBX with no static public IP. Never contains the password or its digest.
    - `enabled` boolean: Whether this trunk authenticates by registration rather than by source IP.
    - `username` string, nullable: The SIP username your PBX registers with.
    - `domain` string: SIP domain / digest realm.
    - `server` string: Host and port your PBX registers to.
    - `transport` 'tls': Registration trunks are TLS-only.
    - `passwordSetAt` string, date-time, nullable
    - `registered` boolean: True when your PBX is registered right now.
    - `lastRegisteredAt` string, date-time, nullable
    - `lastRegisteredIp` string, nullable: The address your PBX last registered from.
  - `sipPassword` string: Present ONLY on the response that mints it — creating a registration trunk, enabling registration, or rotating credentials. It cannot be retrieved afterwards; store it immediately.
  - `sipPasswordNotice` string: Human-readable reminder that accompanies `sipPassword`.
  - `createdAt` string, date-time
  - `updatedAt` string, date-time

## Other responses

- `400`: `registration_not_enabled` — enable registration on the trunk first.
- `401`: Missing, unknown, or badly signed credentials — check the HMAC and the timestamp skew.
- `404`: No such resource on this account.

---

[API](https://skmtc.dev/callnode/apis/callnode-outbound-api.md) · [All operations](https://skmtc.dev/callnode/apis/callnode-outbound-api/llms.txt) · [OpenAPI document](https://skmtc.dev/callnode/apis/callnode-outbound-api/revisions/c7da6ad06509?raw)