Rotate the client secret
Mints a new client secret and returns the plaintext once. The
previous secret remains valid for POST /oauth/token for 24
hours after rotation, then is destroyed (sweeper job).
Re-rotating before the prior overlap window closes is rejected
with rotation_in_progress (409) to prevent a 3-key chain.
Idempotency-Key header is accepted.
Authorizations
Same flow; ledger:write is required for any mutation.
Headers
Required on writes. Stable identifier you choose. The same key
always returns the same transaction, forever. Can also be supplied as
idempotency_key in the request body. Header wins.
Allowed character set: A-Z, a-z, 0-9, _, :, ., -.
Max 255 bytes. Replays of an accepted key return the original
response with header Idempotent-Replayed: true so callers can
tell a replay from a freshly-committed result.
1 - 255^[A-Za-z0-9_:.\-]+$"pi_acme_1234_capture"
Path Parameters
Response
Rotated. Body includes one-time client_secret.
oauth_client The client_id, prefixed client_.
"client_3Jx9XfQwVZBfwUyZQ8H6"
"ci-keys"
live, test Plaintext secret. Returned only on create + rotate.
Hint to the integrator that the secret is shown once.
Returned on rotate. UTC timestamp 24h in the future, until which
the previous secret continues to authenticate at POST /oauth/token.