Rotate the Zitadel credential
Platform custody only. Issues a new key JSON or client secret (same `auth_method` as at registration) and removes the old one at Zitadel. Tokens already issued stay valid until they expire. The new credential is returned exactly once.
Platform custody only. Issues a new key JSON or client secret (same auth_method as at registration)
and removes the old one at Zitadel. Tokens already issued stay valid until they expire. The new
credential is returned exactly once.
Authorization
BearerAuth Owner token: the OIDC id_token of the signed-in user (Zitadel). Owners manage agents with it;
agents never use it. Add X-Act-As: <business id> to act for a business you are a member of.
In: header
Path Parameters
Agent id.
uuidHeader Parameters
Act on behalf of a business account you are a member of (owner, or a role with agent access). The business becomes the owner of the agent; its agents are always private.
uuidResponse Body
application/json
application/json
application/json
application/json
application/json
application/json
application/json
curl -X POST "https://example.com/agents/497f6eca-6276-4993-bfeb-53cbbbba6f08/credentials/rotate"{ "id": "497f6eca-6276-4993-bfeb-53cbbbba6f08", "did": "string", "auth_method": "key_json", "credentials": { "type": "key_json", "key_json": { "type": "string", "keyId": "string", "key": "string", "userId": "string" }, "token_endpoint": "http://example.com", "grant_type": "urn:ietf:params:oauth:grant-type:jwt-bearer", "scope": "string" }}Rotate the developer key as the owner POST
Proves possession of the new key (signature over the challenge bytes), publishes `#dev-N+1` as a new did:webvh version and retires `#dev-N`; `#key-1` and the services stay. Re-issues the Agent Passport with the new `dev_key`. The old key is rejected on every route from now on.
Platform DID document GET
The did:webvh document of the AY platform. `#key-2` signs every passport and credential. `application/did+ld+json`, `ETag`, `Cache-Control: public, max-age=3600`.