Skip to main content
POST
Rotate the client secret

Authorizations

Authorization
string
header
required

Same flow; ledger:write is required for any mutation.

Headers

Idempotency-Key
string

Required on writes. Stable identifier you choose. The same key always returns the same transaction, forever. Can also be supplied as idempotency_key in the request body. Header wins.

Allowed character set: A-Z, a-z, 0-9, _, :, ., -. Max 255 bytes. Replays of an accepted key return the original response with header Idempotent-Replayed: true so callers can tell a replay from a freshly-committed result.

Required string length: 1 - 255
Pattern: ^[A-Za-z0-9_:.\-]+$
Example:

"pi_acme_1234_capture"

Path Parameters

id
string
required

Response

Rotated. Body includes one-time client_secret.

object
enum<string>
required
Available options:
oauth_client
id
string
required

The client_id, prefixed client_.

Example:

"client_3Jx9XfQwVZBfwUyZQ8H6"

name
string
required
Example:

"ci-keys"

scopes
string[]
required
mode
enum<string>
required
Available options:
live,
test
active
boolean
required
created_at
string<date-time>
required
ledger_id
string<uuid> | null
last_used_at
string<date-time> | null
client_secret
string

Plaintext secret. Returned only on create + rotate.

client_secret_note
string

Hint to the integrator that the secret is shown once.

previous_secret_expires_at
string<date-time>

Returned on rotate. UTC timestamp 24h in the future, until which the previous secret continues to authenticate at POST /oauth/token.