---
title: "Rotate Credential"
method: POST
path: "/v2/org/{org}/nico/credential/rotation"
tags: ["Credential Rotation"]
---

# Rotate Credential

`POST /v2/org/{org}/nico/credential/rotation`

Stage a site-wide credential rotation: publish a new rotate-to secret
and bump the site-wide target version. Devices converge to the new
version asynchronously; poll the status endpoint to observe
convergence. Equivalent to `nico-admin-cli credential rotate`.

User must have authorization role with `PROVIDER_ADMIN` suffix.

## Request body

- CredentialRotationRequest — Request to stage a site-wide credential rotation.
  - `siteId` string, uuid, required — ID of the Site whose credential family is rotated.
  - `credentialType` 'BMC' | 'HostUEFI' | 'DPUUEFI' | 'NVOS' | 'LockdownIKM', required — Credential family to rotate.
  - `password` string — Explicit rotate-to password. When omitted, a strong password is auto-generated. Never returned.
  - `reason` string — Free-form operator note recorded with the rotation. Must not contain secrets.

## Response `200`

Credential rotation was staged

- CredentialRotationResult — Result returned when a credential rotation is staged. The password is never returned.
  - `credentialType` 'BMC' | 'HostUEFI' | 'DPUUEFI' | 'NVOS' | 'LockdownIKM', required — Credential family that was rotated.
  - `targetVersion` integer, required — Newly published site-wide target version that devices converge to.
  - `started` string, date-time, nullable — When the rotation was staged.

## Other responses

- `400` — Error response when request data cannot be validated
- `403` — Error response when user is not authorized to call an endpoint or retrieve/modify objects

## Changes

- **2026-08-19** `484497856a94` — 1 breaking
  - the `targetVersion` response's property type/format changed from `integer`/`int64` to `integer`/`uint32` for status `200`
- **2026-07-29** `45aed597123d` — 1 info
  - endpoint added

[Change history](https://skmtc.dev/nvidia/apis/nvidia-infra-controller-rest-api/changes/v2/org/:org/nico/credential/rotation/post.md)

---

[API](https://skmtc.dev/nvidia/apis/nvidia-infra-controller-rest-api.md) · [All operations](https://skmtc.dev/nvidia/apis/nvidia-infra-controller-rest-api/llms.txt) · [OpenAPI document](https://skmtc-service-production.skmtc.workers.dev/v1/apis/nvidia/nvidia-infra-controller-rest-api/revisions/022fecfce466/schema)