> ## Documentation Index
> Fetch the complete documentation index at: https://docs.siro.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# Rotate an API client secret

> Issues a new secret and returns it once. The client id does not change, the previous secret keeps working until the next rotation, and only the caller who created the client can rotate it.

Issues a new secret for an existing [client app](/authentication). The `clientId` does not change.

The new `clientSecret` is returned **once**. Store it immediately. The previous secret keeps working until you rotate again.

Only the caller who created the client can rotate it.


## OpenAPI

````yaml post /v1/core/m2m-clients/{organizationId}/{clientId}/rotate-secret
openapi: 3.0.0
info:
  version: 1.0.0
  title: Swagger API
servers:
  - url: https://api.siro.ai/
    description: Siro API Gateway
security: []
externalDocs:
  description: View the raw OpenAPI Specification in JSON format
  url: /swagger.json
paths:
  /v1/core/m2m-clients/{organizationId}/{clientId}/rotate-secret:
    post:
      summary: Rotate an API client secret
      description: >-
        Issues a new secret and returns it once. The client id does not change,
        the previous secret keeps working until the next rotation, and only the
        caller who created the client can rotate it.
      parameters:
        - schema:
            type: string
            description: The organization this client belongs to.
          required: true
          description: The organization this client belongs to.
          name: organizationId
          in: path
        - schema:
            type: string
            description: The id of the API client.
          required: true
          description: The id of the API client.
          name: clientId
          in: path
      responses:
        '200':
          description: Rotate an API client secret
          content:
            application/json:
              schema:
                type: object
                properties:
                  data:
                    type: object
                    properties:
                      clientId:
                        type: string
                        description: The id of the API client.
                      clientSecret:
                        type: string
                        description: >-
                          The client secret, returned only in this response and
                          not stored.
                    required:
                      - clientId
                      - clientSecret
                  cursor:
                    anyOf:
                      - type: string
                      - type: number
                      - nullable: true
                  pageSize:
                    type: number
                  limit:
                    type: number
                  total:
                    type: number
                    nullable: true
                  hasNextPage:
                    type: boolean
                required:
                  - data
        '400':
          description: Bad Request - Invalid parameters
          content:
            application/json:
              schema:
                type: object
                properties:
                  error:
                    type: string
                    description: Error message
                required:
                  - error
        '401':
          description: Unauthorized - User not authenticated
          content:
            application/json:
              schema:
                type: object
                properties:
                  error:
                    type: string
                    description: Authentication error message
                required:
                  - error
        '403':
          description: Forbidden - User does not have access
          content:
            application/json:
              schema:
                type: object
                properties:
                  error:
                    type: string
                    description: Authorization error message
                required:
                  - error
        '404':
          description: Not Found - Resource not found
          content:
            application/json:
              schema:
                type: object
                properties:
                  error:
                    type: string
                    description: Resource not found error message
                required:
                  - error
        '422':
          description: Unprocessable Content - The request failed validation checks
          content:
            application/json:
              schema:
                type: object
                properties:
                  issues:
                    type: array
                    items:
                      type: object
                      properties:
                        code:
                          type: string
                        expected:
                          type: string
                        received:
                          type: string
                        path:
                          type: array
                          items:
                            anyOf:
                              - type: string
                              - type: number
                        message:
                          type: string
                      required:
                        - code
                        - path
                        - message
                  name:
                    type: string
                    enum:
                      - ZodError
                required:
                  - issues
                  - name
        '500':
          description: Internal Server Error
          content:
            application/json:
              schema:
                type: object
                properties:
                  error:
                    type: string
                    description: Internal server error message
                required:
                  - error
      security:
        - SiroAuthToken: []
components:
  securitySchemes:
    SiroAuthToken:
      type: apiKey
      in: header
      name: x-siro-auth-token
      description: >-
        Access token from POST https://auth.siro.ai/oauth2/token
        (client_credentials), or a Siro OAuth access token. Send
        `x-siro-auth-token: <access-token>`.
      x-default: <access-token>

````