---
title: "Rotate a callback credential"
method: POST
path: "/v1/exceptions/callbacks/credentials/{credentialId}/rotate"
tags: ["Exception"]
---

# Rotate a callback credential

`POST /v1/exceptions/callbacks/credentials/{credentialId}/rotate`

Atomically supersedes a live callback credential with a freshly minted one (same label) and returns the new raw token ONCE. The old credential is revoked in the same transaction.

## Path parameters

- `credentialId` string, uuid, required — Id of the live credential to rotate

## Response `201`

Created

- CredentialSecretResponse
  - `createdAt` string, required — Mint time (RFC 3339, UTC)
  - `credentialId` string, uuid, required — Surrogate id of the minted credential
  - `externalSystem` string — Operator-legible external-system label, echoed for confirmation
  - `token` string, required — Raw bearer token, surfaced exactly once; configure it as the X-Callback-Token header value in the external system. Only its SHA-256 hash is stored server-side.
  - `webhookUrlHint` string — Informational inbound-callback URL shape to configure in the external system. The {exceptionId} placeholder is filled per callback.

## Other responses

- `default` — Error

---

[API](https://skmtc.net/lerian/apis/identity-plugin.md) · [All operations](https://skmtc.net/lerian/apis/identity-plugin/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/lerian/identity-plugin/versions/25daba385532/schema)