---
title: "Rotate Api Credential Secret"
method: POST
path: "/api-credentials/{id}/rotate"
tags: ["ApiCredentials"]
---

# Rotate Api Credential Secret

`POST /api-credentials/{id}/rotate`

## Request

- Base URL: `https://api.purplegrain.com/api/v1`
- URL: `https://api.purplegrain.com/api/v1/api-credentials/{id}/rotate`
- Auth: HTTP bearer

Regenerate the client_secret. The old secret stops authenticating at
/oauth/token immediately; access tokens already minted survive until
expiry — including long-lived UI-minted ones (revoke those via
DELETE /oauth-tokens/{id}, or delete the credential to kill everything).
The response includes the new client_secret exactly once.

## Path parameters

- `id` string, required

## Response `200`

Rotated — includes the new client_secret (show-once).

- ApiCredentialsShowResponseAttributes
  - `data` ApiCredentialModelAttributes: Single API credential in attributes-adapter shape (Accept application/json): id, type and attribute fields at top level.
    - `id` string: The OAuth client_id (application uid).
    - `type` string
    - `name` string
    - `scopes` string
    - `owner_type` 'User' | 'Organization'
    - `owner_id` string, uuid
    - `created_at` string, date-time
    - `client_secret` string: Present ONLY in create and rotate responses (show-once).

## Other responses

- `401`: Unauthorized
- `403`: Forbidden
- `404`: Not Found

---

[API](https://skmtc.dev/purplegrain/apis/purple-grain-api.md) · [All operations](https://skmtc.dev/purplegrain/apis/purple-grain-api/llms.txt) · [OpenAPI document](https://skmtc.dev/purplegrain/apis/purple-grain-api/revisions/a9136f78e9fb?raw)