Preview — pending review
This reference is generated from the platform API contract and is still under review. Operations, fields, and descriptions can change before publication.
Rotate an OpenStack API credential (new secret revealed once)
Mints a successor credential with the same owner, project and profile (capped again by the current
projection) and returns its secret exactly once. The old credential keeps working until the end of the
overlap window (overlapHours, 0-168, default 24) so OCCM / CI secrets can be updated; the reconciler
then deletes it (revokeReason: rotation). Same authorization as create (interactive session + MFA
step-up), plus the revoke rules for the old credential.
Errors: as create; 409 when the credential is not active or already rotated.
bearerTokenAuthorizationBearer <token>An API token (pc_live_…) or a service-account key (sak_live_…), created in Identity & Access Management and sent as Authorization: Bearer <token>. Requests are rate limited per credential and per tenant: every response carries X-RateLimit-Limit, X-RateLimit-Remaining and X-RateLimit-Reset, and a refused request gets 429 RATE_LIMITED with Retry-After.
scopeId*stringOpaque ownership+authorization scope resolving to tenant + subscription + project.
credentialId*stringIdentifier of the credential to rotate.
Idempotency-Key?stringOptional; recommended for safe retries. When sent, the same key+body within 24h replays the original result and the same key with a different body is 409 CONFLICT; keys are unique per tenant. When an API token or service-account (bearer) caller omits it, the request is applied once with no replay protection (a retry may apply it again). A console session gets one from the edge.
uuidapplication/json- body
overlapHours?integerHow long the old credential keeps working (default 24).
0 <= value <= 168expiresInDays?integerLifetime of the successor (default the old credential's lifetime).
1 <= value <= 365Successor created; its secret is in this response only.
application/json- response
credential*An OpenStack application credential minted by the platform (the secret is never included).
secret*The one-time secret material plus what a clouds.yaml / openrc needs.
previous*An OpenStack application credential minted by the platform (the secret is never included).
curl -X POST "https://example.com/scopes/string/iam/openstack-credentials/string/actions/rotate" \ -H "Content-Type: application/json" \ -d '{}'{ "credential": { "id": "string", "name": "string", "projectId": "string", "owner": { "kind": "user", "id": "string" }, "profile": "full", "roles": [ "string" ], "status": "active", "applicationCredentialId": "string", "expiresAt": "2019-08-24T14:15:22Z", "createdAt": "2019-08-24T14:15:22Z", "createdBy": "string", "lastUsedAt": "2019-08-24T14:15:22Z", "revokedAt": "2019-08-24T14:15:22Z", "revokeReason": "user", "rotatedFromId": "string", "replacedById": "string", "deleteAfter": "2019-08-24T14:15:22Z" }, "secret": { "applicationCredentialId": "string", "applicationCredentialSecret": "string", "authUrl": "string", "regionName": "string", "interface": "string" }, "previous": { "id": "string", "name": "string", "projectId": "string", "owner": { "kind": "user", "id": "string" }, "profile": "full", "roles": [ "string" ], "status": "active", "applicationCredentialId": "string", "expiresAt": "2019-08-24T14:15:22Z", "createdAt": "2019-08-24T14:15:22Z", "createdBy": "string", "lastUsedAt": "2019-08-24T14:15:22Z", "revokedAt": "2019-08-24T14:15:22Z", "revokeReason": "user", "rotatedFromId": "string", "replacedById": "string", "deleteAfter": "2019-08-24T14:15:22Z" }}