Rotate a machine client secret

POST

/api/machine-clients/{id}/rotate-secret

Maintainer:Not configured

OperationId:rotate_machine_client_secret

Installs a fresh secret for a temper-issued machine client. The previous secret stays valid for grace_seconds (0 to 604800). The new client_secret in the response is shown once and never stored. Requires a system admin or the owner of the machine's owning team. When the machine sits on a person's personal team and anyone but that person makes this credential, the machine is removed from that personal team in the same transaction. Any other caller with system access is answered 404, exactly as for an id that does not exist. Where an external identity provider mints this instance's tokens, the credential is still dormant: true.

Request

Authorization

JWT Bearer

Add the parameter

Authorization

to Headers

Example:

Authorization: ********************

Path Params

Header Params

Body Params application/jsonRequired

Examples

Responses

🟢200OK

application/json

The machine client and its new one-time client_secret

Bodyapplication/json

🟠400Bad Request

🟠401Unauthorized

🟠403Forbidden

🟠404Record Not Found

Request Example

Shell

JavaScript

Java

Swift

curl --location '/api/machine-clients//rotate-secret' \
--header 'X-Temper-Surface;' \
--header 'Authorization: Bearer <token>' \
--header 'Content-Type: application/json' \
--data '{
    "grace_seconds": 0
}'

Response Example

200 - Example 1

{
    "client": {
        "client_id": "string",
        "created": "2019-08-24T14:15:22.123Z",
        "id": "497f6eca-6276-4993-bfeb-53cbbbba6f08",
        "issuer": "string",
        "label": "string",
        "last_seen_at": "2019-08-24T14:15:22.123Z",
        "profile_id": "bfcb6779-b1f9-41fc-92d7-88f8bc1d12e8",
        "registered_by_profile_id": "18e6908a-ccb7-48bf-a180-a379e0568e01",
        "revoked_at": "2019-08-24T14:15:22.123Z",
        "revoked_by_profile_id": "e2512452-9e5c-40a6-8117-21bb43a829e4",
        "secret_rotated_by_profile_id": "d73cae19-470b-43f5-9688-cb1abc10cb63",
        "team_id": "810007d0-bec5-486c-b5d1-28fcd8a079ba"
    },
    "client_secret": "string",
    "dormant": true
}

Modified at 2026-10-31 18:33:26

Revoke a machine client

List subscriptions