---
title: "Get Credential Rotation Status"
method: GET
path: "/v2/org/{org}/nico/credential/rotation"
tags: ["Credential Rotation"]
---

# Get Credential Rotation Status

`GET /v2/org/{org}/nico/credential/rotation`

Report convergence of an in-flight or completed site-wide credential
rotation. When `deviceMac` is set, the counts describe just that device
and a per-device detail block is returned. Equivalent to
`nico-admin-cli credential rotation-status`.

User must have authorization role with `PROVIDER_ADMIN` suffix.

## Query parameters

- `siteId` string, uuid, required
- `credentialType` 'BMC' | 'HostUEFI' | 'DPUUEFI' | 'NVOS' | 'LockdownIKM', required
- `deviceMac` string

## Response `200`

Credential rotation status

- CredentialRotationStatus — Convergence status of an in-flight or completed site-wide credential rotation.
  - `targetVersion` integer, required — Current site-wide target version for this family.
  - `converged` integer, required — Number of devices at or beyond the target version.
  - `pending` integer, required — Number of devices not yet converged and eligible to rotate.
  - `quarantined` integer, required — Number of devices currently in a rotation backoff window.
  - `quarantinedDeviceMacs` string[], nullable — MAC addresses of the quarantined devices.
  - `started` string, date-time, nullable — When the current target version was staged.
  - `complete` boolean, required — True only when every device in the queried set has reached the target with none pending and none quarantined.
  - `device` DeviceCredentialRotationStatus — Per-device convergence detail, returned only for a MAC-targeted status query.
    - `deviceMac` string, required — The device this status describes.
    - `currentVersion` integer, nullable — Credential version live on the hardware. Null when not yet established.
    - `rotatingToVersion` integer, nullable — Set while a rotation is mid-flight on this device.
    - `converged` boolean, required — True once the current version reaches the site-wide target.
    - `quarantined` boolean, required — True while the device is in a rotation backoff window.
    - `quarantinedUntil` string, date-time, nullable — When the current backoff window expires; set only while quarantined.
    - `rotateAttempts` integer, required — Number of rotation attempts recorded for this device.
    - `lastAttempted` string, date-time, nullable — When the last rotation attempt ran; null if none.
    - `lastError` string, nullable — Redacted last-error string for observability; never a secret.

## Other responses

- `400` — Error response when request data cannot be validated
- `403` — Error response when user is not authorized to call an endpoint or retrieve/modify objects
- `404` — No rotation record exists for the requested device

## Changes

- **2026-08-19** `484497856a94` — 7 breaking
  - the `converged` response's property type/format changed from `integer`/`int64` to `integer`/`uint64` for status `200`
  - the `device/currentVersion` response's property type/format changed from `integer, null`/`int64` to `integer, null`/`uint32` for status `200`
  - the `device/rotateAttempts` response's property type/format changed from `integer`/`int64` to `integer`/`uint32` for status `200`
  - the `device/rotatingToVersion` response's property type/format changed from `integer, null`/`int64` to `integer, null`/`uint32` for status `200`
  - …3 more
- **2026-07-29** `45aed597123d` — 1 info
  - endpoint added

[Change history](https://skmtc.dev/nvidia/apis/nvidia-infra-controller-rest-api/changes/v2/org/:org/nico/credential/rotation/get.md)

---

[API](https://skmtc.dev/nvidia/apis/nvidia-infra-controller-rest-api.md) · [All operations](https://skmtc.dev/nvidia/apis/nvidia-infra-controller-rest-api/llms.txt) · [OpenAPI document](https://skmtc-service-production.skmtc.workers.dev/v1/apis/nvidia/nvidia-infra-controller-rest-api/revisions/022fecfce466/schema)