---
title: "Rotate DataHub internal authentication secrets"
method: POST
path: "/project/{project}/service/{service_name}/rotate-internal-secrets"
tags: ["Service"]
---

# Rotate DataHub internal authentication secrets

`POST /project/{project}/service/{service_name}/rotate-internal-secrets`

Generates fresh values for DATAHUB\_SECRET (Play session signing key) and DATAHUB\_SYSTEM\_CLIENT\_SECRET (system OAuth client secret), updates every DataHub app child accordingly, and triggers a coordinated restart so the new values take effect everywhere simultaneously. USER-VISIBLE SIDE EFFECT: every active browser session is invalidated -- all currently logged-in users will be signed out and must re-login after the coordinated restart. Inter-service calls may briefly return 401 errors while the rotation is in flight. DATAHUB\_SYSTEM\_CLIENT\_ID is the fixed identifier "\_\_datahub\_system" and is intentionally left untouched.

## Path parameters

- `project` string, required
- `service_name` string, required

## Response `200`

Response

- ServiceDataHubRotateInternalSecretsResponse — ServiceDataHubRotateInternalSecretsResponse
  - `errors` object[] — List of errors occurred during request processing
    - `message` string, required — Printable error message
    - `more_info` string — URL to the documentation of the error
    - `status` integer, required — HTTP error status code
  - `message` string, required — Printable result of the request
  - `rotation` object, required — DatahubSecretRotationGroup
    - `group` string, required — Rotated secret group

## Other responses

- `404` — Resource not found
- `409` — Request conflict

---

[API](https://skmtc.net/aiven/apis/aiven-api-documentation.md) · [All operations](https://skmtc.net/aiven/apis/aiven-api-documentation/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/aiven/aiven-api-documentation/revisions/ecaeabf1da31/schema)