---
title: "Rotate the client secret"
method: POST
path: "/accounts/integrations/{id}/secrets"
tags: ["Integrations"]
---

# Rotate the client secret

`POST /accounts/integrations/{id}/secrets`

## Request

- Base URL: `https://api.quiva.ai`
- URL: `https://api.quiva.ai/accounts/integrations/{id}/secrets`
- Auth: one of:
  - HTTP bearer
  - API key in header `x-api-key`
- TypeScript: <https://skmtc.dev/quivaworks/apis/quiva-ai-gateway/docs/accounts/integrations/:id/secrets/post.ts> (a function with typed inputs; its response is checked against the schema)

Issues a new secret, shown once. The previous live secret retires after `grace_seconds`. At most two secrets are live.

## Path parameters

- `id` string, required

## Request body

- RotateSecretRequest
  - `grace_seconds` integer: Default 604800 (7 days). 0 retires the old secret immediately.

## Response `200`

Rotated.

- object
  - `data` SecretRotated, required
    - `integration` Integration, required
      - `id` string, required: Also the OAuth `client_id`.
      - `account_id` string, required
      - `name` string, required
      - `user_id` string, required: The principal user that writes are attributed to.
      - `environment` string, required: Label only in this release.
      - `scopes` IntegrationScopes, required: Space id to scopes. Space ids are upper-cased on write and match `^\w{1,64}$`. At most 500 spaces.
      - `secrets` IntegrationSecretView[], required
        - `secret_id` string, required
        - `last_4` string, required
        - `created_at` string, date-time, required
        - `created_by` string, required
        - `retires_at` string, date-time
        - `revoked_at` string, date-time
        - `last_used_at` string, date-time
      - `token_epoch` integer, required
      - `disabled` boolean, required
      - `deleted_at` string, date-time
      - `created_at` string, date-time
      - `updated_at` string, date-time
      - `created_by` string
    - `secret_id` string, required
    - `client_secret` string, required: Shown once.

## Other responses

- `400`: Bad request. `code` names the cause.
- `401`: Not authenticated, the caller is not a root or admin user, or the integration token was revoked (`token_revoked`).
- `403`: Forbidden: `scope_denied`, or `integration_not_allowed` for an integration bearer outside workspaces.
- `404`: Not found.
- `409`: `two_secrets_live`.
- `503`: A backing store is unreachable. Retry. `code` is `storage_unavailable`.

## Changes

- **2026-10-08** `bcf3a5f49584`: 1 info
  - endpoint added

[Operation history](https://skmtc.dev/quivaworks/apis/quiva-ai-gateway/changes/accounts/integrations/:id/secrets/post.md)

---

[API](https://skmtc.dev/quivaworks/apis/quiva-ai-gateway.md) - [All operations](https://skmtc.dev/quivaworks/apis/quiva-ai-gateway/llms.txt) - [OpenAPI document](https://skmtc.dev/quivaworks/apis/quiva-ai-gateway/revisions/700eb1ace61a?raw)