---
title: "Rotate or re-bind a secret"
method: PATCH
path: "/projects/{projectId}/secrets/{secretId}"
tags: ["Secrets"]
---

# Rotate or re-bind a secret

`PATCH /projects/{projectId}/secrets/{secretId}`

Rotate the value and/or change how it is delivered. A rotation reaches NEW RUNS ONLY: a session already running holds the old value — materialized in its box's environment, or inside an egress policy that cannot be read back — and there is no safe way to replace it mid-run.

## Request body

- SecretUpdateRequest — At least one field. `name` and `sharing` are absent because both are IMMUTABLE: renaming would break the workflows referencing the environment variable, and re-sharing would change who has already been handed the value. Delete and recreate for either. A rotation reaches NEW RUNS ONLY — a session already running holds the old value and cannot be reached.
  - `value` string — The new credential. Same exposure as on create: it travels in this body.
  - `description` string, nullable — `null` clears it; omit to leave it unchanged.
  - `delivery` 'brokered' | 'materialized' — Switching to `brokered` requires the host binding in the same call; switching to `materialized` clears it.
  - `brokerHosts` string[] — Required for `brokered`, forbidden for `materialized`. Exact hostnames — no scheme, no port, no wildcard: the proxy matches a host, and a URL installs a rule that silently never fires.
  - `brokerHeader` string — Required for `brokered`, forbidden for `materialized`. e.g. `Authorization`.
  - `brokerTemplate` string — Required for `brokered`, forbidden for `materialized`. The header value with `{}` where the secret goes, e.g. `Bearer {}`. A template without `{}` is rejected: it installs a constant header that never carries the credential.

## Response `200`

The updated secret, as metadata.

- Secret — A project credential — METADATA ONLY, always. There is no `value` field on this schema and no route that returns one: a secret is written and delivered into a run, never read back.
  - `id` string, required
  - `projectId` string, required
  - `name` string, required — The environment-variable name (`^[A-Z_][A-Z0-9_]*$`). This IS the secret's identity: what a materialized delivery exports, what a workflow references, and what stays stable across a rotation. Immutable.
  - `description` string, nullable, required
  - `delivery` 'brokered' | 'materialized', required — `brokered` — the sandbox's egress proxy injects the value as a request header OUTSIDE the VM, so the box never holds it. Prevents EXTRACTION, not USE: any process in the box can call the bound host while the policy is live, and it works for HTTPS APIs only (domain rules bind on ports 80/443). `materialized` — a real environment variable inside the box, which is the only thing a CLI can read; EXTRACTABLE BY DESIGN.
  - `brokerHosts` string[] — Brokered only: the exact hostnames the header is injected on.
  - `brokerHeader` string — Brokered only: the header name.
  - `brokerTemplate` string — Brokered only: the header value, with `{}` where the secret goes.
  - `sharing` 'user' | 'project', required — `project` — admin-managed, delivered to every member's sessions. `user` — personal, delivered ONLY in sessions its owner starts and silently absent from anyone else's run of the same environment. Immutable.
  - `ownerUserId` string — Personal secrets only. Project-shared rows have no owner.
  - `lastDeliveredAt` integer, nullable, required — When this secret was last HANDED TO a run — not when it was last used. Brokered use is unobservable by construction (the proxy injects the header; the request is never seen here), so `used` would be a number nobody can honestly produce. `null` means nothing has been recorded, which is not the same as never delivered.
  - `createdAt` integer, required
  - `updatedAt` integer, required
  - `createdByUserId` string, required
  - `updatedByUserId` string, required

## Other responses

- `400` — Malformed body or parameters.
- `401` — Missing, invalid, revoked, or orphaned key (`UNAUTHORIZED`) — or the **target MCP server** needs an OAuth grant (`OAUTH_REQUIRED`), which is a property of the server, not your key.
- `403` — Key is valid but not allowed to do this.
- `404` — Unknown project, server, or resource.
- `409` — The resource is not in a state that accepts this write — a stale `expectedRevision`, a duplicate name, or an environment that cannot currently be launched. The request was well-formed; re-read the resource and retry.
- `429` — Per-key rate limit exceeded (60 requests/minute sustained, bursts up to 10). Honor `Retry-After` and back off with jitter.
- `500` — Something failed on MCPJam's side.

## Changes

- **2026-09-01** `ce6e4188e558` — 1 info
  - endpoint added

[Change history](https://skmtc.dev/mcpjam/apis/mcpjam-api/changes/projects/:projectId/secrets/:secretId/patch.md)

---

[API](https://skmtc.dev/mcpjam/apis/mcpjam-api.md) · [All operations](https://skmtc.dev/mcpjam/apis/mcpjam-api/llms.txt) · [OpenAPI document](https://skmtc-service-production.skmtc.workers.dev/v1/apis/mcpjam/mcpjam-api/revisions/3d62c6919d8d/schema)