Skip to main content
POST
Rotate a partner credential secret

Authorizations

Authorization
string
header
required

Authorization: Bearer <token>. Token types resolve to the same scoped credential: a user-generated API key (casa_…, from Account settings — recommended for first-party machines and MCP clients), a partner credential access token (third-party agents; REST-only), a session JWT (the web app; org and role come from verified token claims), or a static token. API keys are group-scoped, optionally pinned to one property at creation. Partner credentials reject X-Property-Id. MCP OAuth connector tokens authenticate the MCP server only and are rejected on these REST routes.

Headers

X-Organization-Id
string

Active organization (property group). Optional cross-check for session (JWT) auth: when sent it must equal the token's verified org_id claim, else 403. The org is taken from the claim, not this header. Ignored for API keys, partner credentials, and static tokens.

Path Parameters

id
string<uuid>
required

Resource id (UUID).

Response

New secret shown once.

data
object
required

An org-scoped partner credential. Casa never returns or stores the plaintext client secret after create or rotate.

client_id
string
required
client_secret
string
required