---
title: "Restore a revoked secret"
method: POST
path: "/api/v1/account/credentials/secrets/{secretId}/restore"
tags: ["Credentials"]
---

# Restore a revoked secret

`POST /api/v1/account/credentials/secrets/{secretId}/restore`

## Request

- Base URL: `https://api.sahha.ai` (the document declares no server; this is the origin it was published from)
- URL: `https://api.sahha.ai/api/v1/account/credentials/secrets/{secretId}/restore`
- Auth: API key in header `Authorization`

Makes a revoked secret authenticate again. Any member of the account can restore within 24 hours of the revoke; after that, contact support. Refused while the credential already has two active secrets, and once the secret's own expiry has passed.

## Path parameters

- `secretId` string, uuid, required

## Query parameters

- `environment` string

## Request body

- RestoreCredentialSecretRequest
  - `accountId` string, uuid: The account the credential belongs to.
  - `environment` string: sandbox or production. It must be the environment the request is sent to.
  - `credentialType` string: application or client.

## Response `200`

Every secret of the credential after the restore.

- CredentialSecretsResponse
  - `secrets` CredentialSecretDto[]: Every secret of the credential after the change.
    - `id` string, uuid: The secret's id, used to revoke or restore it.
    - `credentialType` string: application or client.
    - `isLegacy` boolean: True for a secret issued before rotation launched. Its value stays readable on the credential while it can authenticate.
    - `status` string: active, expired or revoked.
    - `hint` string, nullable: The secret's prefix and last four characters, such as sahha_app_prod_...Ab3x, enough to tell secrets apart and to confirm a revoke. A legacy secret's hint is its last four characters alone.
    - `createdAt` string, date-time
    - `expiresAt` string, date-time, nullable: When the secret stops authenticating. Null while it has no expiry.
    - `revokedAt` string, date-time, nullable
    - `restoredAt` string, date-time, nullable
    - `lastUsedAt` string, date-time, nullable: The last time the secret authenticated, to within five minutes.

## Other responses

- `400`: The request isn't valid, or its environment isn't the one it was sent to.
- `401`: Not signed in.
- `403`: Not a member of the account, or more than 24 hours since the revoke.
- `404`: The account has no such credential in the environment, or the credential has no secret with this id.
- `409`: The secret isn't revoked, has expired, or two secrets are already active.
- `429`: Too many credential changes by this user.

---

[API](https://skmtc.dev/sahha/apis/sahha-platform-v1.md) - [All operations](https://skmtc.dev/sahha/apis/sahha-platform-v1/llms.txt) - [OpenAPI document](https://skmtc.dev/sahha/apis/sahha-platform-v1/revisions/c7f918b46707?raw)