SparQDocs
GuidesAPI referencesparqhq.ai
API referenceCredentials

Rotate Credential

POST
/v1/admin/credentials/{credential_id}/rotate

Issue a successor credential linked to this one; this one becomes rotated.

Authorization

HTTPBearer
headerAuthorizationBearer <token>

Bearer credential. API keys look like sqk_<geo>_<key_id>_<secret>: treat them as opaque and never put one in a browser. Older keys without the geo part stay valid until rotated. Find a geo's endpoints through GET /.well-known/sparq-discovery before sending a key.

Path Parameters

credential_id*Credential Id
Formatuuid

Header Parameters

Sparq-Workspace?string

For a person signed in to a console with several workspaces: the workspace this call is for, one of their memberships (listMyMemberships). Without it such a person gets workspace_required (400); a workspace they are not a member of is forbidden. It never grants anything, and other callers' credentials ignore it.

Formatuuid
Idempotency-Key?string

Makes a retry safe: the same key, route and body within 24 hours returns the stored response and the same result id. The same key with a different body or route is idempotency_conflict; while the first request runs, idempotency_in_progress.

Length8 <= length <= 128

Response Body

Successful Response

application/json
  1. response

Returned once, when Sparq creates or rotates a secret. The secret is not stored readable.

credential*
secret*|

The new secret, shown once and never again. Empty for credentials that hold no Sparq-generated secret. Clients must not log it.

Example Request
curl -X POST 'http://dev-sparq.centralindia.cloudapp.azure.com:8000/v1/admin/credentials/497f6eca-6276-4993-bfeb-53cbbbba6f08/rotate'
Example Response
{  "credential": {    "credential_id": "13c40afa-2996-4a0c-b2e9-68fba9462242",    "type": "project_api_key",    "status": "active",    "owner": {      "kind": "person",      "name": "string",      "contact": "string"    },    "workspace_id": "0967198e-ec7b-4c6b-b4d3-f71244cadbe9",    "project_id": "405d8375-3514-403b-8c43-83ae74cfe0e9",    "environment": "string",    "environment_id": "40ef0e48-a11f-4963-a229-e396c9f7e7c4",    "purpose": "string",    "fingerprint": "string",    "predecessor_id": "c8bad2a2-4d3d-486b-89ca-11a0c911eff9",    "created_at": "2019-08-24T14:15:22Z",    "rotated_at": "2019-08-24T14:15:22Z",    "expires_at": "2019-08-24T14:15:22Z",    "revoked_at": "2019-08-24T14:15:22Z"  },  "secret": "string"}

Revoke Credentials POST

> **Not available yet.** This operation is part of the published contract and answers `501 not_implemented` until it is built. The request and response shapes below are final for this contract version. Revoke up to 100 credentials. One result per credential, never all-or-nothing.

Get Features GET

> **Not available yet.** This operation is part of the published contract and answers `501 not_implemented` until it is built. The request and response shapes below are final for this contract version. Each feature's effective value with `locked` and `reason`, to draw the composer switches.