Rotate the Organization's tool signing secret

POST /v1/tool-signing-secret/rotate

Property	Value
Operation	`rotate_tool_signing_secret`
Group	Tools
Scope	`tools:write`
Route class	`control`
Idempotency	`Idempotency-Key` accepted: a retry with the same key replays the first answer
Audit	Audited `tool_signing_secret.rotate` (mutation)
Released in	1.49.0
Phase 0 host	Served (the hosted api pins 1.65.0)

Mints a new tool signing secret and answers it once. The previous secret keeps signing beside it for previous_secret_expires_in_s (86,400 by default), so every http Tool request in the window carries two v1 values, the new one first; rotating again inside the window retires the oldest. A replay under the same Idempotency-Key rotates nothing and answers secret null.

Request

Set VOCAL_API to the base URL of your API and VOCAL_API_KEY to an API key with the tools:write scope (Authentication and keys). Replace each placeholder, such as agt_... or <name>, with your own value.

curl -X POST "$VOCAL_API/v1/tool-signing-secret/rotate" \
  -H "Authorization: Bearer $VOCAL_API_KEY" \
  -H "Idempotency-Key: $(uuidgen)" \
  -H "Content-Type: application/json" \
  -d '{}'

const response = await fetch(`${process.env.VOCAL_API}/v1/tool-signing-secret/rotate`, {
  method: 'POST',
  headers: {
    Authorization: `Bearer ${process.env.VOCAL_API_KEY}`,
    'Idempotency-Key': crypto.randomUUID(),
    'Content-Type': 'application/json',
  },
  body: JSON.stringify({}),
});
console.log(response.status, await response.text());

import os
import uuid

import requests

response = requests.post(
    f"{os.environ['VOCAL_API']}/v1/tool-signing-secret/rotate",
    headers={
        "Authorization": f"Bearer {os.environ['VOCAL_API_KEY']}",
        "Idempotency-Key": str(uuid.uuid4()),
    },
    json={},
)
print(response.status_code, response.text)

Parameters

Name	In	Type	Required	Description
`idempotency-key`	header	string	no	A client-chosen key, kept 24 hours per Organization, environment and route. A replay returns the stored response.

Request body

Content type application/json, required: ToolSigningSecretRotateRequest.

Field	Type	Required	Description
`previous_secret_expires_in_s`	integer	no	How long the previous secret keeps signing beside the new one, 0 to 604,800 seconds; 86,400 when omitted. 0 retires it at once.

Responses

Status	Content type	Shape	Error codes
`200`	`application/json`	ToolSigningSecretRotation
`400`	`application/json`	ErrorEnvelope	`invalid_request`
`401`	`application/json`	ErrorEnvelope	`unauthenticated`
`403`	`application/json`	ErrorEnvelope	`forbidden`, `org_suspended`
`409`	`application/json`	ErrorEnvelope	`idempotency_in_progress`, `idempotency_key_reused`
`429`	`application/json`	ErrorEnvelope	`rate_limited`
`500`	`application/json`	ErrorEnvelope	`internal_error`

Fields of the `200` answer

The shape is ToolSigningSecretRotation.

Field	Type	Required	Description
`object`	`"tool_signing_secret_rotation"`	yes
`previous_secret_expires_at`	Timestamp or null	yes	When the previous secret stops signing, or null when none does.
`previous_secret_hint`	string or null	yes	The last four characters of the secret that keeps signing through the window, or null when none does.
`rotated_at`	Timestamp	yes
`secret`	ToolSigningSecret or null	yes	The new secret, shown in this answer only; null in the answer to a replay under the same `Idempotency-Key`, which rotated nothing.
`secret_hint`	string	yes	The last four characters of the new secret.