---
title: "Rotate datasource instance credentials"
method: POST
path: "/rest/api/v1/datasource/{datasourceInstanceId}/credentials"
tags: ["Datasources"]
---

# Rotate datasource instance credentials

`POST /rest/api/v1/datasource/{datasourceInstanceId}/credentials`

Rotates the credentials that a datasource instance uses to connect to its upstream system. Replaces the active credential material with the supplied values and returns the credential status after rotation. Access is limited to callers with the ADMIN scope; the handler enforces this check.
Only keys recognized as credential material for the datasource type may be set in `credentials.values` (e.g. `clientSecret`, `apiToken`, `privateKey`, depending on the configured auth method). Unrecognized keys, or keys that correspond to non-credential configuration, cause a 400; other instance configuration must be updated via PATCH /configure/datasources/{datasourceId}/instances/{instanceId}.

## Path parameters

- `datasourceInstanceId` string, required

## Request body

- RotateDatasourceCredentialsRequest — Request to rotate the credentials used by a datasource instance. Replaces the active credential material with the supplied values. `credentials.values` must contain only keys recognized as credential material for the datasource type (for example `clientSecret` for OAuth, `apiToken` for API-token auth, `privateKey` for certificate auth). Unrecognized keys, or keys that correspond to non-credential configuration, cause a 400; use the configure endpoint to change non-credential config.
  - `credentials` DatasourceInstanceConfiguration, required — Configuration for a datasource instance
    - `values` ConfigurationValues, required — A map from configuration key names to their values

## Response `200`

OK

- DatasourceCredentialStatusResponse — Status of the credentials currently installed for a datasource instance.
  - `status` 'VALID' | 'VALID_WITH_WARNINGS' | 'VALIDATING' | 'INVALID' | 'MISSING', required — Lifecycle state of the credentials installed for a datasource instance. Mirrors the internal admin Status enum so the handler can surface the same health signals already tracked today. EXPIRING_SOON is represented as VALID_WITH_WARNINGS (with detail in `message`); EXPIRED is surfaced as INVALID plus a non-null `expiresAt` in the past.
  - `lastRotatedAt` string, date-time — When the credentials were last rotated. Omitted when not known.
  - `expiresAt` string, date-time — When the active credentials expire. Omitted when not known or not applicable to this credential type.
  - `message` string — Optional human-readable detail about the current credential status.

## Other responses

- `400` — Invalid request
- `401` — Not authorized
- `403` — Forbidden
- `404` — Datasource instance not found

---

[API](https://skmtc.net/gleanwork/apis/glean-api.md) · [All operations](https://skmtc.net/gleanwork/apis/glean-api/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/gleanwork/glean-api/revisions/ebd602e4aea4/schema)