Rotate a callback credential

Atomically supersedes a live callback credential with a freshly minted one (same label) and returns the new raw token ONCE. The old credential is revoked in the same transaction. This route does not replay a response. A retry, even with the same X-Idempotency key, answers 404 because the old credential is already revoked.

POST /v1/exceptions/callbacks/credentials/{credentialId}/rotate

Rotate a callback credential

cURL

curl --request POST \
  --url https://matcher.sandbox.lerian.net/v1/exceptions/callbacks/credentials/{credentialId}/rotate \
  --header 'Authorization: Bearer <token>'

201

Example

{
  "createdAt": "<string>",
  "credentialId": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
  "token": "<string>",
  "externalSystem": "<string>",
  "webhookUrlHint": "<string>"
}

Autorizaciones

Authorization · string · header · requerido

Bearer token authentication (format: "Bearer {token}")

Parámetros de ruta

credentialId · string<uuid> · requerido

Id of the live credential to rotate

Ejemplo:

"550e8400-e29b-41d4-a716-446655440000"

Respuesta

201

application/json

Created

createdAt · string · requerido

Mint time (RFC 3339, UTC)

credentialId · string<uuid> · requerido

Surrogate id of the minted credential

token · string · requerido

Raw bearer token, surfaced exactly once; configure it as the X-Callback-Token header value in the external system. Only its SHA-256 hash is stored server-side.

externalSystem · string

Operator-legible external-system label, echoed for confirmation

webhookUrlHint · string

Informational inbound-callback URL shape to configure in the external system. The {exceptionId} placeholder is filled per callback.