Rotate now.

POST

/v1/projects/{projectId}/secrets/{secretId}/rotate

Shell / cURL

curl --request POST \
  --url https://stratum.example.com/v1/projects/example/secrets/example/rotate \
  --header 'Authorization: Bearer <token>'

Marks the schedule due; the secrets reconciler runs the rotation on its next pass (within a minute) and the schedule’s lastRotation* fields report the outcome. Cedar-gated on secrets:RotateSecret. 404 when the secret has no schedule.

Authorizations

bearerAuth

Parameters

Path Parameters

projectId

required

string

/^p-[a-z0-9-]+$/

secretId

required

string

/^s-[a-z0-9]+$/

Responses

202

Rotation requested.

application/json

A secret’s rotation schedule (0–1 per secret). At 2.0 the rotator is a built-in: iam_access_key (a service account’s signing key), s3_access_key, or db_master (a Stratum Database instance’s master password, the service keeps one on a password it generated; set one yourself to rotate a password you supplied). The platform decides WHEN (this schedule, run by the secrets reconciler) and the built-in decides HOW. A rotation puts the new credential as PENDING, verifies it authenticates, promotes it to CURRENT, and retires the previous credential after rotationWindowHours. A failure before promote leaves CURRENT untouched and revokes the new credential again.

object

required

string

secretId

required

string

rotationType

required

string

Allowed values: iam_access_key s3_access_key db_master

rotationTarget

required

The credential owner the rotator acts on — a service account id or ARN for iam_access_key; the S3 access-key owner for s3_access_key; the database instance id or ARN for db_master, set on that instance’s own master secret. Must belong to the secret’s project.

string

scheduleCron

required

Standard 5-field cron (minute hour day-of-month month day-of-week), e.g. 0 3 1 * *.

string

rotationWindowHours

required

How long the previous credential stays valid after a promote, and how long a rotation may take before it is failed as stuck (1–168, default 6).

integer

enabled

required

boolean

nextRotationAt

required

string format: date-time

rotateRequestedAt

Set by POST.../rotate; cleared when the rotation starts.

string format: date-time

lastRotationStartedAt

string format: date-time

lastRotationCompletedAt

string format: date-time

lastRotationResult

string

Allowed values: success failure in_progress

lastRotationError

string

createdAt

required

string format: date-time

updatedAt

required

string format: date-time

Example

{
  "rotationType": "iam_access_key",
  "lastRotationResult": "success"
}

403

Authenticated but not authorized.

application/problem+json

object

type

required

string format: uri

title

required

string

status

required

integer

>= 400 <= 599

detail

string

instance

string format: uri-reference

requestId

required

string

code

required

string

issues

The findings of a rejected IAM policy document (custom and resource policies).

Array<object>

One finding of a rejected IAM policy document. A rejection lists every finding, so the author fixes the document in one round trip.

object

code

required

The finding, e.g. INVALID_DOCUMENT, UNKNOWN_ACTION, ACTION_NOT_APPLICABLE.

string

statement

required

Index of the statement at fault; -1 for the document as a whole.

integer

>= -1

detail

required

string

action

The offending action, where one is at fault (ACTION_NOT_APPLICABLE).

string

errors

Field errors, for codes that carry them: each problem at its field (see FieldError). Documented on the responses that set it, e.g. approveNodeJoin’s INVALID_INPUT and JOIN_APPROVAL_REFUSED. Absent otherwise.

Array<object>

One field’s problem, the stage-2 installer API’s shape. field is the field’s path, message what is wrong with it.

object

field

required

The field’s path, e.g. links[0].interface, disks[1].confirm, mgmt.address or role; empty for the whole request.

string

message

required

string

details

Structured facts about the refusal, for codes that carry them. The shape is fixed per code and documented on the response that answers it, e.g. IMAGE_POOL_MISMATCH (see ImagePoolMismatchDetails) and IMAGE_IN_USE. Absent for codes that carry none.

object

key

additional properties

any

Example

{
  "issues": [
    {
      "code": "ACTION_NOT_APPLICABLE",
      "action": "compute:CreateVpc"
    }
  ]
}

404

Resource not found.

application/problem+json

object

type

required

string format: uri

title

required

string

status

required

integer

>= 400 <= 599

detail

string

instance

string format: uri-reference

requestId

required

string

code

required

string

issues

The findings of a rejected IAM policy document (custom and resource policies).

Array<object>

One finding of a rejected IAM policy document. A rejection lists every finding, so the author fixes the document in one round trip.

object

code

required

The finding, e.g. INVALID_DOCUMENT, UNKNOWN_ACTION, ACTION_NOT_APPLICABLE.

string

statement

required

Index of the statement at fault; -1 for the document as a whole.

integer

>= -1

detail

required

string

action

The offending action, where one is at fault (ACTION_NOT_APPLICABLE).

string

errors

Array<object>

One field’s problem, the stage-2 installer API’s shape. field is the field’s path, message what is wrong with it.

object

field

required

The field’s path, e.g. links[0].interface, disks[1].confirm, mgmt.address or role; empty for the whole request.

string

message

required

string

details

object

key

additional properties

any

Example

{
  "issues": [
    {
      "code": "ACTION_NOT_APPLICABLE",
      "action": "compute:CreateVpc"
    }
  ]
}