Skip to main content
This reserved endpoint is present in the HTTP contract, but the current service implementation does not rotate credentials.

​
Endpoint

POST /v3/onboarding/managed_accounts/credentials/rotate

​
Authentication and target

A user-scoped owner credential is required. The selected managed account must be visible through the user’s active Master Account relationship. This route does not become accessible merely by adding account-targeting headers. Do not send X-ISPB or X-Account-Number. This user-only management route rejects account-targeting headers. The account selector documented below belongs in the JSON request body.

​
Request body

Send exactly one of reference_id or account.

​
Success data

No successful credential payload is implementation-backed today. Although the compiled contract contains reserved new-credential and old-key-expiry fields, the current service returns before producing them.

​
Behavior and validation

Every valid call currently returns the unsupported-operation business error (business code 503 in the normal HTTP 200 envelope). The human-readable message is localized; do not branch on it. Do not build a production rotation workflow around this endpoint until the service implementation changes and the documentation is revised.

​
Errors

Every call can fail for missing or invalid signature headers, an expired timestamp, nonce replay, an invalid body hash or signature, insufficient permission, or a downstream service error. Endpoint-specific errors include:
  • invalid_parameter for an invalid selector.
  • Business code 503 for the implemented unsupported-operation branch. The normal transport status remains HTTP 200; the localized message is not a stable machine identifier.

​
Example request

​
Example response