Rotate credential with grace window or INLINE hard cutover

post

https://staging.ankatech.co/api/v3/admin/tenants/{tenantId}/actors/{actorId}/credentials/rotate

Mints a new credential at version N+1. Existing active credentials transition based on graceWindowHours: when 0, INLINE TX hard cutover to REVOKED (no intermediate state observable); when 1..720 (default 24), transition to ROTATING_OUT with revoke_at = now + graceWindowHours and continue to authenticate until the @Scheduled finalizer flips them to REVOKED. The request body is optional (defaults apply when omitted).

Recent Requests

Time	Status	User Agent
Retrieving recent requests…

Loading…

Path Params

tenantId

uuid

required

actorId

uuid

required

Body Params

Optional rotation parameters: validity window for the new credential plus graceWindowHours controlling how long existing active credentials continue to authenticate after the rotation.

publicJwk

string

The actor's NEW public JWK. Required when rotating a PRIVATE_KEY_JWT credential and refused when rotating a CLIENT_SECRET one. Admitted under the same per-kty allow-list as issuance. A FEDERATED_JWT actor has no credential to rotate at all — its trust is re-declared on the issuer binding.

validFrom

date-time

New credential becomes valid at this instant (ISO-8601). Defaults to server now() when omitted.

validUntil

date-time

New credential becomes invalid at this instant. Null = no expiry.

graceWindowHours

int32

0 to 720

Hours the existing active credentials continue to authenticate after this rotation (1..720 = grace window via ROTATING_OUT state; 0 = INLINE hard cutover to REVOKED; null = default 24).

Headers

string

enum

Defaults to application/json

Generated from available response content types

Allowed:

content-type

string

enum

Defaults to application/json

Generated from available request content types

Allowed:

Responses

Language

Credentials

Bearer

JWT

URL

Loading…

Response

Click Try It! to start a request and see the response here! Or choose an example:

application/json

application/problem+json

201Rotation succeeded — new credential plaintext in body

400Invalid graceWindowHours (< 0 or > 720), or invalid validity window

404Actor not found in tenant

503This deployment has no public edge base URL configured (PUBLIC_EDGE_BASE_URL), so the audience this workload must name in its assertions cannot be derived. The question is asked before the first write, so no credential was stored and no prior credential was revoked.