ApiCredentials

Rotate Api Credential Secret

Regenerate the client_secret. The old secret stops authenticating at /oauth/token immediately; access tokens already minted survive until expiry — including long-lived UI-minted ones (revoke those via DELETE /oauth-tokens/{id}, or delete the credential to kill everything). The response includes the new client_secret exactly once.

post/api-credentials/{id}/rotate

Request

  • Base URL: https://api.purplegrain.com/api/v1
  • URL: https://api.purplegrain.com/api/v1/api-credentials/{id}/rotate
  • Auth: HTTP bearer

Path parameters

idstring required

Response

Rotated — includes the new client_secret (show-once).

Example response

{
  "data": {
    "type": "api-credential"
  }
}

Changes

No recorded changes to this operation across all 2 revisions of this API.