Skip to content
Authrim

Rotate Credential.

POST
/api/admin/machine-access/principals/{id}/credentials/{credentialId}/rotate
Code sample: Shell / cURL 
curl --request POST \
  --url https://auth.example.com/api/admin/machine-access/principals/example/credentials/example/rotate \
  --header 'Authorization: Bearer <token>' \
  --header 'Content-Type: application/json' \
  --data '{ "kid": "kid-2026-02", "display_name": "Rotated signing key", "alg": "ES256", "public_jwk": { "kty": "EC", "crv": "P-256", "x": "...", "y": "..." }, "overlap_seconds": 86400 }'

Rotate Credential in the Machine Access area. The request body is JSON unless the detailed schema for this operation states otherwise.

Authorizations

Section titled “Authorizations ”

Parameters

Section titled “ Parameters ”

Path Parameters

Section titled “Path Parameters ”
id
required
string
credentialId
required
string

Request Body required

Section titled “Request Body required ”

Rotate a machine credential and optionally override permissions or scopes.

Media type application/json
object
kid
required
string
display_name
required
string
alg
required
string
public_jwk
required
object
key
additional properties
description
Any of:
string
not_before
Any of:
integer format: int64
expires_at
Any of:
integer format: int64
permissions
required
Array<string>
tenant_scopes
required
Array<object>
object
scope_mode
required
string
Allowed values: none all allow
tenant_id
Any of:
string
overlap_seconds
integer format: int64
Example 
{
  "kid": "kid-2026-02",
  "display_name": "Rotated signing key",
  "alg": "ES256",
  "public_jwk": {
    "kty": "EC",
    "crv": "P-256",
    "x": "...",
    "y": "..."
  },
  "overlap_seconds": 86400
}

Responses

Section titled “ Responses ”

201

Section titled “201 ”

Machine credential rotation result.

Media type application/json
object
credential
required
object
id
string
principalId
string
kid
string
publicJwkJson
string
alg
string
Allowed values: ES256 PS256 RS256
displayName
string
description
Any of:
string
status
string
Allowed values: active rotating revoked expired
notBefore
Any of:
integer format: int64
expiresAt
Any of:
integer format: int64
createdAt
integer format: int64
updatedAt
integer format: int64
previous_credential
required
Any of:
object
id
string
principalId
string
kid
string
publicJwkJson
string
alg
string
Allowed values: ES256 PS256 RS256
displayName
string
description
Any of:
string
status
string
Allowed values: active rotating revoked expired
notBefore
Any of:
integer format: int64
expiresAt
Any of:
integer format: int64
createdAt
integer format: int64
updatedAt
integer format: int64
Example 
{
  "credential": {
    "id": "amk_new",
    "principalId": "amp_123",
    "kid": "kid-2026-02",
    "alg": "ES256",
    "displayName": "Rotated signing key",
    "status": "active"
  },
  "previous_credential": {
    "id": "amk_old",
    "principalId": "amp_123",
    "kid": "kid-2026-01",
    "alg": "ES256",
    "displayName": "Production signing key",
    "status": "rotating",
    "expiresAt": 1770086400000
  }
}

default

Section titled “default ”

Error response.

Media type application/json
object
error
string
message
string
error_description
string
key
additional properties
Example generated
{
  "error": "example",
  "message": "example",
  "error_description": "example"
}