---
title: "Rotate Agent Credential"
method: POST
path: "/agents/{id}/credentials/{cid}/rotate"
tags: ["agents-credentials"]
---

# Rotate Agent Credential

`POST /agents/{id}/credentials/{cid}/rotate`

## Request

- Base URL: `https://api.instruxi.dev/api/v1/enforcer`
- URL: `https://api.instruxi.dev/api/v1/enforcer/agents/{id}/credentials/{cid}/rotate`
- Auth: one of:
  - API key in header `Authorization`
  - API key in header `X-API-Key`

Issues a replacement secret (returned once; the new row records rotated_from) and lets the old one keep working for grace_seconds (0-86400, default 0 = it stops now). A revoked or expired credential is 409 credential_revoked.

## Path parameters

- `id` string, required
- `cid` string, required

## Request body

- InternalDeliveryHttpHandlerRotateAgentCredentialRequest
  - `grace_seconds` integer: GraceSeconds is how long the old secret keeps working (0-86400).

## Response `200`

OK

- InternalDeliveryHttpHandlerRotatedAgentCredentialResponse
  - `data` EnforcerV3InternalUsecaseAgentsRotatedCredential
    - `credential` EnforcerV3InternalUsecaseAgentsCredentialView
      - `agent_id` string
      - `created_at` string
      - `created_by` string
      - `expires_at` string
      - `id` string
      - `key_prefix` string
      - `last_used_at` string
      - `last_used_ip` string
      - `name` string
      - `revoked_at` string
      - `rotated_from` string
      - `scopes` string[]
    - `previous` EnforcerV3InternalUsecaseAgentsRotatedPrevious
      - `expires_at` string
      - `id` string
    - `secret` string
  - `success` boolean

## Other responses

- `400`: Bad Request
- `401`: Unauthorized
- `403`: Forbidden
- `404`: Not Found
- `409`: Conflict

---

[API](https://skmtc.dev/instruxi/apis/enforcer-api.md) · [All operations](https://skmtc.dev/instruxi/apis/enforcer-api/llms.txt) · [OpenAPI document](https://skmtc.dev/instruxi/apis/enforcer-api/revisions/fa82bc1becc0?raw)