--- title: "Rotate a vault credential" method: POST path: "/vaults/{vault_id}/credentials/{credential_id}" tags: ["Vaults"] --- # Rotate a vault credential `POST /vaults/{vault_id}/credentials/{credential_id}` Rotates a vault credential's write-only secret and returns only credential metadata. See [vaults](https://developers.openai.com/api/docs/guides/agents-api/tools/vaults). ## Path parameters - `vault_id` string, required - `credential_id` string, required ## Request body - RotateVaultCredentialParams — Secret, expiry, and OAuth refresh scope updates for an existing vault credential. - `auth` union, required — Updates to a vault credential without changing its authentication method or MCP server. - object — Rotate an OAuth credential for an HTTPS MCP destination. - `type` 'mcp_oauth', required — The type of the object. Always `mcp_oauth`. - `access_token` string, nullable — A write-only replacement OAuth access token. - `expires_at` string, nullable — The replacement expiry as an RFC 3339 timestamp, or `null` to clear it. Omitting this field preserves the expiry unless a new access token is supplied, in which case the expiry is cleared. - `refresh` RotateMcpOauthRefreshParam — Updates to an MCP credential's existing OAuth refresh configuration. - `refresh_token` string, nullable — The replacement refresh token. Omit or pass `null` to keep the stored token. This secret is never returned in resources. - `scope` string, nullable — Replacement space-separated OAuth scopes for refresh requests. Omit to keep the scopes, or pass `null` to stop sending a scope parameter. - `token_endpoint_auth` union — Client-secret updates that preserve the credential's OAuth authentication method. - object — Updates credentials sent using HTTP Basic authentication. - `type` 'client_secret_basic', required — The type of the object. Always `client_secret_basic`. - `client_secret` string, nullable — The replacement OAuth client secret. Omit or pass `null` to keep the stored secret. This secret is never returned in resources. - object — Updates credentials sent in the token request body. - `type` 'client_secret_post', required — The type of the object. Always `client_secret_post`. - `client_secret` string, nullable — The replacement OAuth client secret. Omit or pass `null` to keep the stored secret. This secret is never returned in resources. - object — Replace the bearer token for the credential's MCP server. - `type` 'static_bearer', required — The type of the object. Always `static_bearer`. - `token` string, required — The replacement bearer token. This secret is never returned in credential resources. ## Response `200` The rotated vault credential without secret values. - VaultCredentialResource — Metadata for a stored MCP server credential. Secret values are never returned. - `id` string, required — The ID of the credential. - `object` 'vault.credential', required — The object type. Always `vault.credential`. - `vault_id` string, required — The ID of the vault containing this credential. - `name` string, required — The human-readable name of the credential. - `auth` union, required — The MCP server and authentication configuration of a vault credential, excluding secrets. - object — Public metadata for an OAuth credential; tokens and client secrets are never returned. - `type` 'mcp_oauth', required — The type of the object. Always `mcp_oauth`. - `mcp_server_url` string, required — The HTTPS MCP server URL authorized by this credential. - `expires_at` string, nullable, required — When the OAuth access token expires, as an RFC 3339 timestamp, if known. - `refresh` McpOauthRefreshResource, required — Configuration used to refresh an MCP OAuth access token, excluding secret values. - `token_endpoint` string, required — The HTTPS OAuth token endpoint used for refresh. - `client_id` string, required — The OAuth client ID used when requesting a new access token. - `resource` string, nullable, required — The resource URI sent to the OAuth token endpoint during refresh, if configured. - `scope` string, nullable, required — Space-separated OAuth scopes requested during refresh, if configured. - `token_endpoint_auth` union, required — The client authentication method used for OAuth token refresh. - object — Sends the client ID without a client secret. - `type` 'none', required — The type of the object. Always `none`. - object — Sends the client ID and secret using HTTP Basic authentication. - `type` 'client_secret_basic', required — The type of the object. Always `client_secret_basic`. - object — Sends the client ID and secret in the token request body. - `type` 'client_secret_post', required — The type of the object. Always `client_secret_post`. - object — Metadata for a bearer-token credential, without automatic OAuth refresh. - `type` 'static_bearer', required — The type of the object. Always `static_bearer`. - `mcp_server_url` string, required — The HTTPS MCP server URL authorized by this credential. - `created_at` integer, required — The Unix timestamp, in seconds, when the credential was created. - `updated_at` integer, required — The Unix timestamp, in seconds, when the credential was last updated. ## Other responses - `400` — The request was invalid. - `401` — Authentication or project context was missing. - `403` — The API key lacks the required management permission. - `404` — The requested vault or credential was not found. - `409` — The request conflicted with the current vault state. - `500` — An internal error occurred. - `503` — The service is temporarily unavailable. ## Changes - **2026-09-10** `f2dae1a9aced` — 1 info - endpoint added [Change history](https://skmtc.dev/openai/apis/openapi/changes/vaults/:vault_id/credentials/:credential_id/post.md) --- [API](https://skmtc.dev/openai/apis/openapi.md) · [All operations](https://skmtc.dev/openai/apis/openapi/llms.txt) · [OpenAPI document](https://skmtc.dev/openai/apis/openapi/revisions/c8bd56db4095?raw)