Rotate the caller's own tenant secret — owner only

POST

/operator/tenant/rotate-secret

curl --request POST \
  --url http://localhost:3000/operator/tenant/rotate-secret \
  --header 'Authorization: Bearer <token>'

A flag day, same as POST /admin/tenants/{id}/rotate-secret: no kid, no keyset, the old secret dies immediately. Reuses the same service method, so the Redis tenant-cache invalidation cannot be forgotten here. member may read the tenant but not rotate its secret — only owner and staff (via the /admin/tenants route) may.

Authorizations

• operatorToken

Responses

200

The new secret. Returned once, here — never readable again afterwards.

Media typeapplication/json

object

api_secret

string

Example^generated

{
  "api_secret": "example"
}

401

Invalid, expired, revoked, or absent token.

Media typeapplication/json

object

error

required

object

code

required

string

Allowed values: VALIDATION_FAILED UNAUTHENTICATED FORBIDDEN NOT_FOUND CONFLICT RATE_LIMITED INTERNAL

message

required

string

requestId

required

string

fields

Present only for VALIDATION_FAILED.

Array<object>

object

path

string

message

string

Example

{
  "error": {
    "code": "VALIDATION_FAILED"
  }
}

403

Caller is platform staff (no tenant), or a member (role lacks the rotate ability).

Media typeapplication/json

object

error

required

object

code

required

string

Allowed values: VALIDATION_FAILED UNAUTHENTICATED FORBIDDEN NOT_FOUND CONFLICT RATE_LIMITED INTERNAL

message

required

string

requestId

required

string

fields

Present only for VALIDATION_FAILED.

Array<object>

object

path

string

message

string

Example

{
  "error": {
    "code": "VALIDATION_FAILED"
  }
}