---
title: "Atomically rotate an executor credential"
method: POST
path: "/v1/executors/{id}/credentials/rotate"
tags: ["Executors"]
---

# Atomically rotate an executor credential

`POST /v1/executors/{id}/credentials/rotate`

## Request

- Base URL: `https://api.thrd.email`
- URL: `https://api.thrd.email/v1/executors/{id}/credentials/rotate`
- Auth: API key in header `x-admin-token`

Requires a server-authenticated tenant owner/operator with executors:manage. Agent API keys are rejected. The old credential is revoked before the replacement plaintext is returned once.

## Path parameters

- `id` string, required

## Request body

- object
  - `current_credential_id` string, required

## Response `200`

Credential rotated; replacement plaintext returned once

- object
  - `principal_id` string, required
  - `credential_id` string, required
  - `environment` 'development' | 'staging' | 'production', required
  - `credential_token` string, required

## Other responses

- `400`: Strict rotation body invalid
- `403`: Human manager authority unavailable
- `409`: Credential rotation conflict
- `429`: Management rate limit exceeded
- `503`: Management authority unavailable

---

[API](https://skmtc.dev/thrd/apis/thrd-agent-email-api.md) · [All operations](https://skmtc.dev/thrd/apis/thrd-agent-email-api/llms.txt) · [OpenAPI document](https://skmtc.dev/thrd/apis/thrd-agent-email-api/revisions/d8a88129cd34?raw)