foliot docs

API reference / Apps / Rotate the signing secret

Rotate the signing secret

POST/apps/{appId}/signing-secret/rotate

Authenticate with an operator token or an app API key or a signed-in Foliot Console session.

The app’s own key, an operator token, or a signed-in person who is an owner of the app’s workspace. Mints a new secret and keeps the old one verifying for the rollover window, so pushes already in flight — and handlers not yet updated — keep working. The new secret is NOT returned: read it back through reveal, so every disclosure is recorded in one place.

Path parameters

appId
string
REQUIRED

The app's name.

Request body

reason
string
REQUIRED

Why. Required, and recorded.

min length 8 · max length 1000

Responses

200 object OK
400 Error Invalid request.
401 Error Missing, malformed or unknown bearer token.
403 Error The token is valid but not permitted on this route.
404 Error No such resource.
503 Error A dependency this route needs is unreachable.