Rotate the tenant's secret — the old one dies immediately

POST

/admin/tenants/{id}/rotate-secret

const url = 'http://localhost:3000/admin/tenants/example/rotate-secret';
const options = {method: 'POST', headers: {'X-Admin-Key': '<X-Admin-Key>'}};

try {
  const response = await fetch(url, options);
  const data = await response.json();
  console.log(data);
} catch (error) {
  console.error(error);
}

curl --request POST \
  --url http://localhost:3000/admin/tenants/example/rotate-secret \
  --header 'X-Admin-Key: <X-Admin-Key>'

A flag day, deliberately: no kid, no keyset, no multi-key verification. The Redis tenant cache key is deleted inside this operation — without that, “the old secret dies immediately” would be false by up to 60s (spec §5).

Authorizations

adminKey

Parameters

Path Parameters

required

string

Responses

200

The new secret. Returned once.

application/json

object

api_secret