---
title: "POST /rotated-secret-create-azure"
method: POST
path: "/rotated-secret-create-azure"
tags: ["v2"]
---

# POST /rotated-secret-create-azure

`POST /rotated-secret-create-azure`

## Request body

- RotatedSecretCreateAzure
  - `api-id` string — API ID to rotate (relevant only for rotator-type=api-key)
  - `api-key` string — API key to rotate (relevant only for rotator-type=api-key)
  - `application-id` string — Id of the azure app that hold the serect to be rotated (relevant only for rotator-type=api-key & authentication-credentials=use-target-creds)
  - `authentication-credentials` string — The credentials to connect with use-user-creds/use-target-creds
  - `auto-rotate` string — Whether to automatically rotate every --rotation-interval days, or disable existing automatic rotation [true/false]
  - `delete_protection` string — Protection from accidental deletion of this object [true/false]
  - `description` string — Description of the object
  - `explicitly-set-sa` string — If set, explicitly provide the storage account details [true/false]
  - `grace-rotation` string — Enable graceful rotation (keep both versions temporarily). When enabled, a new secret version is created while the previous version is kept for the grace period, so both versions exist for a limited time. [true/false]
  - `grace-rotation-hour` integer — The Hour of the grace rotation in UTC
  - `grace-rotation-interval` string — The number of days to wait before deleting the old key (must be bigger than rotation-interval)
  - `grace-rotation-timing` string — When to create the new version relative to the rotation date [after/before]
  - `input-rule` string[] — Agentic input rule in name=...,rule=... format (e.g. name=rule1,rule=Sanitize input)
  - `item-custom-fields` object — Additional custom fields to associate with the item
  - `json` boolean — Set output format to JSON
  - `key` string — The name of a key that used to encrypt the secret value (if empty, the account default protectionKey key will be used)
  - `lock-during-sra-session` string — Lock this secret for read/update while an SRA session is active
  - `max-versions` string — Set the maximum number of versions, limited by the account settings defaults.
  - `name` string, required — Rotated secret name
  - `output-rule` string[] — Agentic output rule in name=...,rule=... format (e.g. name=rule1,rule=Mask secrets)
  - `password-length` string — The length of the password to be generated
  - `resource-group-name` string — The resource group name (only relevant when explicitly-set-sa=true)
  - `resource-name` string — The name of the storage account (only relevant when explicitly-set-sa=true)
  - `rotate-after-disconnect` string — StringOrBool accepts JSON strings, booleans, and numbers for backward compatibility with older SDK versions that send boolean values for rotate-after-disconnect.
  - `rotation-event-in` string[] — How many days before the rotation of the item would you like to be notified
  - `rotation-hour` integer — The Hour of the rotation in UTC
  - `rotation-interval` string — The number of days to wait between every automatic key rotation (1-365)
  - `rotator-type` string, required — The rotator type. options: [target/password/api-key/azure-storage-account]
  - `secure-access-disable-concurrent-connections` boolean — Enable this flag to prevent simultaneous use of the same secret
  - `secure-access-enable` string — Enable/Disable secure remote access [true/false]
  - `secure-access-url` string — Destination URL to inject secrets
  - `secure-access-web` boolean — Enable Web Secure Remote Access
  - `secure-access-web-browsing` boolean — Secure browser via Akeyless's Secure Remote Access (SRA)
  - `secure-access-web-proxy` boolean — Web-Proxy via Akeyless's Secure Remote Access (SRA)
  - `storage-account-key-name` string — The name of the storage account key to rotate [key1/key2/kerb1/kerb2] (relevat to azure-storage-account)
  - `tags` string[] — Add tags attached to this object
  - `target-name` string, required — The target name to associate
  - `token` string — Authentication token (see `/auth` and `/configure`)
  - `uid-token` string — The universal identity token, Required only for universal_identity authentication
  - `username` string — The user principal name to rotate his password (relevant only for rotator-type=password)

## Response `200`

rotatedSecretCreateAzureResponse wraps response body.

- RotatedSecretCreateOutput
  - `name` string

## Other responses

- `default` — errorResponse wraps any error to return it as a JSON object with one "error" field.

---

[API](https://skmtc.net/akeyless/apis/akeyless-api.md) · [All operations](https://skmtc.net/akeyless/apis/akeyless-api/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/akeyless/akeyless-api/versions/0ceb25634501/schema)