Rotate a secret

Endpoint: POST /v1/vaults/{vault_id}/secret-rotate/{path}
Authentication: Bearer JWT

You can rotate in two ways:

1. Server-generated value — POST /v1/vaults/{vault_id}/secret-rotate/{path} with optional { "length": 32, "charset": "hex", "type": "api_key" }. Requires rotate or write permission.
2. Client-supplied value — PUT to the same path with a new value (see Create / Update). Creates a new version while preserving history.

Server-side generation

curl

curl -X POST "https://api.1claw.xyz/v1/vaults/$VAULT_ID/secret-rotate/api-keys/openai" \
  -H "Authorization: Bearer $TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"length": 32, "charset": "alphanumeric", "type": "api_key"}'

TypeScript

const { data } = await client.secrets.rotateGenerate(vaultId, "api-keys/openai", {
  length: 32,
  charset: "alphanumeric",
  type: "api_key",
});
console.log(data.version);

Python

from oneclaw import create_client

client = create_client(api_key="1ck_...")
resp = client.secrets.rotate_generate(
    vault_id,
    "api-keys/openai",
    length=32,
    charset="alphanumeric",
    type="api_key",
)
print(resp.data["version"])

CLI

1claw secret rotate api-keys/openai --generate -v $VAULT_ID -l 32 -c alphanumeric

Manual rotation (new version via PUT)

curl

curl -X PUT "https://api.1claw.xyz/v1/vaults/$VAULT_ID/secrets/api-keys/openai" \
  -H "Authorization: Bearer $TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"type":"api_key","value":"sk-proj-NEW..."}'

TypeScript

await client.secrets.set(vaultId, "api-keys/openai", "sk-proj-NEW...", {
  type: "api_key",
});

Python

client.secrets.set(vault_id, "api-keys/openai", "sk-proj-NEW...", type="api_key")

After rotation, optionally disable older versions with POST /v1/vaults/{vault_id}/secret-version-disable/{path}/{version}.