---
title: "POST /update-rotated-secret"
method: POST
path: "/update-rotated-secret"
tags: ["v2"]
---

# POST /update-rotated-secret

`POST /update-rotated-secret`

## Request body

- UpdateRotatedSecret — updateRotatedSecret is a command that updates rotated secret. [Deprecated: Use rotated-secret update commands]
  - `ProviderType` string
  - `add-tag` string[] — List of the new tags that will be attached to this item
  - `api-id` string — API ID to rotate
  - `api-key` string — API key to rotate
  - `auto-rotate` string — Whether to automatically rotate every --rotation-interval days, or disable existing automatic rotation [true/false]
  - `aws-region` string — Aws Region (relevant only for aws)
  - `custom-payload` string — Secret payload to be sent with rotation request (relevant only for rotator-type=custom)
  - `description` string — Description of the object
  - `gcp-key` string — Base64-encoded service account private key text
  - `grace-rotation` string — Create a new access key without deleting the old key from AWS for backup (relevant only for AWS) [true/false]
  - `host-provider` string — Host provider type [explicit/target], Default Host provider is explicit, Relevant only for Secure Remote Access of ssh cert issuer, ldap rotated secret and ldap dynamic secret
  - `json` boolean — Set output format to JSON
  - `keep-prev-version` string — Whether to keep previous version [true/false]. If not set, use default according to account settings
  - `key` string — The name of a key that used to encrypt the secret value (if empty, the account default protectionKey key will be used)
  - `lock-during-sra-session` string — Lock this secret for read/update while an SRA session is active
  - `name` string, required — Secret name
  - `new-metadata` string — Deprecated - use description
  - `new-name` string — New item name
  - `new-version` boolean — Deprecated
  - `rm-tag` string[] — List of the existent tags that will be removed from this item
  - `rotate-after-disconnect` string — StringOrBool accepts JSON strings, booleans, and numbers for backward compatibility with older SDK versions that send boolean values for rotate-after-disconnect.
  - `rotated-password` string — rotated-username password
  - `rotated-username` string — username to be rotated, if selected use-self-creds at rotator-creds-type, this username will try to rotate it's own password, if use-target-creds is selected, target credentials will be use to rotate the rotated-password
  - `rotation-hour` integer — The Hour of the rotation in UTC
  - `rotation-interval` string — The number of days to wait between every automatic key rotation (7-365)
  - `rotator-creds-type` string — The credentials to connect with use-self-creds/use-target-creds
  - `rotator-custom-cmd` string — "Custom rotation command (relevant only for ssh target)
  - `same-password` string — Rotate same password for each host from the Linked Target (relevant only for Linked Target)
  - `secure-access-allow-external-user` boolean — Allow providing external user for a domain users (relevant only for rdp)
  - `secure-access-aws-account-id` string — The AWS account id (relevant only for aws)
  - `secure-access-aws-native-cli` boolean — The AWS native cli
  - `secure-access-bastion-issuer` string — Deprecated. use secure-access-certificate-issuer
  - `secure-access-certificate-issuer` string — Path to the SSH Certificate Issuer for your Akeyless Secure Access
  - `secure-access-db-name` string — The DB name (relevant only for DB Dynamic-Secret)
  - `secure-access-db-schema` string — The db schema (relevant only for mssql or postgresql)
  - `secure-access-disable-concurrent-connections` boolean — Enable this flag to prevent simultaneous use of the same secret
  - `secure-access-enable` string — Enable/Disable secure remote access [true/false]
  - `secure-access-host` string[] — Target servers for connections (In case of Linked Target association, host(s) will inherit Linked Target hosts - Relevant only for Dynamic Secrets/producers)
  - `secure-access-rdp-domain` string — Required when the Dynamic Secret is used for a domain user (relevant only for RDP Dynamic-Secret)
  - `secure-access-rdp-user` string — Override the RDP Domain username (relevant only for rdp)
  - `secure-access-url` string — Destination URL to inject secrets
  - `secure-access-web` boolean — Enable Web Secure Remote Access
  - `secure-access-web-browsing` boolean — Secure browser viaAkeyless's Secure Remote Access (SRA) (relevant only for aws or azure)
  - `secure-access-web-proxy` boolean — Web-Proxy via Akeyless's Secure Remote Access (SRA) (relevant only for aws or azure)
  - `ssh-password` string — Deprecated: use RotatedPassword
  - `ssh-username` string — Deprecated: use RotatedUser
  - `storage-account-key-name` string — The name of the storage account key to rotate [key1/key2/kerb1/kerb2]
  - `token` string — Authentication token (see `/auth` and `/configure`)
  - `uid-token` string — The universal identity token, Required only for universal_identity authentication
  - `user-attribute` string — LDAP User Attribute, Default value "cn"
  - `user-dn` string — LDAP User Base DN

## Response `200`

updateRotatedSecretResponse wraps response body.

- UpdateRotatedSecretOutput
  - `name` string

## Other responses

- `default` — errorResponse wraps any error to return it as a JSON object with one "error" field.

---

[API](https://skmtc.net/akeyless/apis/akeyless-api.md) · [All operations](https://skmtc.net/akeyless/apis/akeyless-api/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/akeyless/akeyless-api/versions/0ceb25634501/schema)