> ## Documentation Index
> Fetch the complete documentation index at: https://syteca.com/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# Rotate Secret Password

> Syteca ACB REST API endpoint to trigger immediate password rotation on a secret — generates a new password and updates the target endpoint.

Triggers **immediate** password rotation on the target endpoint — Syteca generates a new password matching the [password policy](/docs/pam/secrets/configure-password-management), updates the target system, and stores the new password. Use this when you need ad-hoc rotation outside the regular schedule (responding to a possible credential compromise, end of contractor engagement, compliance audit).

<Note>
  For ACB deployments updated from a version prior to 1.2, switch to the `https://{hostname}/EkranACB` server in the Playground.
</Note>

### Permissions required

The user owning the Access Token must have **Editor** or **Owner** role on the secret.

### Synchronous trigger, async target update

The rotation is **synchronous** with respect to triggering, but the actual target endpoint update may take a few seconds depending on the secret type and target system response time. To check rotation status, retrieve the secret via [`GET /api/secrets/{id}`](/docs/api/acb/endpoints/get-secret) and inspect the `password_rotation_status` and `last_password_rotation_utc` fields (NEW in v1.4).

### Errors

See [Status codes](/docs/api/acb/api-reference#status-codes). Common errors:

* **403 Forbidden** — user lacks Editor/Owner role.
* **404 Not Found** — secret doesn't exist.
* **500 Internal Server Error** — rotation attempted but target endpoint rejected the new password. Check the Management Tool **Audit Log** for details. The secret's `password_rotation_status` becomes `Failed`.

## Related

<CardGroup cols={2}>
  <Card title="Heartbeat" icon="activity" href="/docs/api/acb/endpoints/heartbeat">Verify post-rotation password validity.</Card>
  <Card title="Update secret" icon="file-pen" href="/docs/api/acb/endpoints/update-secret">Schedule rotation via the `rotation` field.</Card>
  <Card title="Get secret" icon="info" href="/docs/api/acb/endpoints/get-secret">Check `password_rotation_status` after triggering.</Card>
  <Card title="Data models" icon="braces" href="/docs/api/acb/data-models#passwordrotationstatus">PasswordRotationStatus enum.</Card>
</CardGroup>


## OpenAPI

````yaml POST /api/secrets/{id}/rotate-secret-password
openapi: 3.0.3
info:
  title: Application Credentials Broker API
  description: >-
    API for managing secrets and folders in the Application Credentials Broker
    system
  version: 1.4.0
  contact:
    name: API Support
    email: support@example.com
servers:
  - url: https://your-syteca-host/SytecaACB
    description: On-premises Syteca ACB service (v1.2 or later)
    variables:
      hostname:
        default: your-syteca-host.example.com
        description: Your Syteca Application Server hostname
  - url: https://your-syteca-host/EkranACB
    description: Legacy URL prefix for ACB deployments updated from pre-v1.2
    variables:
      hostname:
        default: your-syteca-host.example.com
        description: Your Syteca Application Server hostname
security:
  - AccessTokenAuth: []
paths:
  /api/secrets/{id}/rotate-secret-password:
    post:
      tags:
        - Secrets
      summary: Rotate secret password
      description: Initiates password rotation for the specified secret
      operationId: rotateSecretPassword
      parameters:
        - name: id
          in: path
          required: true
          description: The ID of the secret to rotate password for
          schema:
            type: integer
            format: int32
            minimum: 1
      responses:
        '204':
          description: Password rotation initiated successfully
        '403':
          description: Access denied
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
        '404':
          description: Secret not found
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
components:
  schemas:
    ErrorResponse:
      type: object
      properties:
        status:
          type: integer
          description: HTTP status code
        message:
          type: string
          description: Error message
      required:
        - status
        - message
  securitySchemes:
    AccessTokenAuth:
      type: apiKey
      in: header
      name: Authorization
      description: Access token for authentication

````