---
title: "Rotate a hosted connection Secret Manager ref"
method: POST
path: "/connections/{connection_id}/secret-ref/rotate"
---

# Rotate a hosted connection Secret Manager ref

`POST /connections/{connection_id}/secret-ref/rotate`

## Request

- Base URL: `https://api.gravityads.dev` (the document declares no server; this is the origin it was published from)
- URL: `https://api.gravityads.dev/connections/{connection_id}/secret-ref/rotate`
- Auth: HTTP bearer

Marks older active control-plane secret refs as rotated, records the new hashed Secret Manager/KMS ref as active, and updates connection token metadata without returning raw token material.

## Request body

- object
  - `secret_manager_resource` string, required: Secret Manager resource name; hashed before persistence and never returned in responses.
  - `kms_key_resource` string: Optional KMS key resource name; hashed before persistence.
  - `version_alias` string
  - `status` string
  - `connection_status` string
  - `granted_scopes` string[]
  - `missing_scopes` string[]

## Response `200`

Secret ref rotated

- object
  - `status` 'connection_secret_ref_recorded' | 'connection_secret_ref_revoked' | 'connection_secret_ref_rotated' | 'connection_secret_ref_not_found' | 'connection_secret_ref_unconfigured' | 'connection_secret_ref_failed' | 'connection_secret_ref_degraded', required
  - `tenant_id` string, required
  - `connection_id` string, required
  - `secret_ref_id` string
  - `version_alias` string
  - `revoked_count` integer
  - `rotated_count` integer
  - `connection` object
  - `secret_vault_readiness` object
  - `ready_for_readonly_etl` boolean
  - `database_url_configured` boolean, required
  - `platform_revoke_called` false, required
  - `hosted_auth_context` object
  - `raw_secrets_returned` false, required

---

[API](https://skmtc.dev/gravityads/apis/gravityads-api.md) · [All operations](https://skmtc.dev/gravityads/apis/gravityads-api/llms.txt) · [OpenAPI document](https://skmtc.dev/gravityads/apis/gravityads-api/revisions/124cd07d534d?raw)