Rotate a hosted connection Secret Manager ref

Marks older active control-plane secret refs as rotated, records the new hashed Secret Manager/KMS ref as active, and updates connection token metadata without returning raw token material.

post/connections/{connection_id}/secret-ref/rotate

Request

  • Base URL: https://api.gravityads.dev (the document declares no server; this is the origin it was published from)
  • URL: https://api.gravityads.dev/connections/{connection_id}/secret-ref/rotate
  • Auth: HTTP bearer

Request body

secret_manager_resourcestring required

Secret Manager resource name; hashed before persistence and never returned in responses.

kms_key_resourcestring

Optional KMS key resource name; hashed before persistence.

version_aliasstring
statusstring
connection_statusstring
granted_scopesstring[]
missing_scopesstring[]

Response

Secret ref rotated

status'connection_secret_ref_recorded' | 'connection_secret_ref_revoked' | 'connection_secret_ref_rotated' | 'connection_secret_ref_not_found' | 'connection_secret_ref_unconfigured' | 'connection_secret_ref_failed' | 'connection_secret_ref_degraded' required
tenant_idstring required
connection_idstring required
secret_ref_idstring
version_aliasstring
revoked_countinteger
rotated_countinteger
connectionobject
secret_vault_readinessobject
ready_for_readonly_etlboolean
database_url_configuredboolean required
platform_revoke_calledfalse required
hosted_auth_contextobject
raw_secrets_returnedfalse required

Changes

No recorded changes to this operation across all 1 revision of this API.