## Rotate the secret

`POST /v1/infra/servers/:id/jobs/:jobId/rotate-secret`

Rotates the signing secret and shows its new value once. The feature must be available; the `enabled` value is not changed. The next attempt uses the new secret, while a request already sent may be signed with the old one. On the app side, keep the previous secret for 5 minutes or accept that those requests are rejected. Your app's 401 and 403 responses are final: rotating the secret does not resend those requests.

Requires a key with `vibe:infra` and existing permissions on the server. Writes need the managing key or a development team role permitted to manage the lifecycle. General rules: [Scheduled HTTP calls](../jobs.md). Request verification in the handler: [Verify signatures](./signature.md).

## Parameters

| Parameter | In | Type | Required | Description |
|---|---|---|---|---|
| `id` | path | string | yes | Server ID from the [server list](../servers/list.md) |
| `jobId` | path | string | yes | Job ID from the [job list](./list.md) |

No request body or query parameters are needed.

## Examples

### curl — personal key

```bash
curl --max-time 20 -X POST "https://vibecode.bitrix24.com/v1/infra/servers/SERVER_ID/jobs/JOB_ID/rotate-secret" \
  -H "X-Api-Key: YOUR_API_KEY"
```

### curl — OAuth application

```bash
curl --max-time 20 -X POST "https://vibecode.bitrix24.com/v1/infra/servers/SERVER_ID/jobs/JOB_ID/rotate-secret" \
  -H "X-Api-Key: YOUR_APP_KEY" \
  -H "Authorization: Bearer USER_SESSION_TOKEN"
```

### JavaScript — personal key

```javascript
const serverId = 'SERVER_ID';
const jobId = 'JOB_ID';
const res = await fetch(`https://vibecode.bitrix24.com/v1/infra/servers/${encodeURIComponent(serverId)}/jobs/${encodeURIComponent(jobId)}/rotate-secret`, {
  method: 'POST',
  headers: {
    'X-Api-Key': 'YOUR_API_KEY',
  },
});
const result = await res.json();
if (!res.ok || !result.success) throw new Error(result.error?.code ?? `HTTP_${res.status}`);
// Store result.data.secret in protected server-side configuration; never log it.
```

### JavaScript — OAuth application

```javascript
const serverId = 'SERVER_ID';
const jobId = 'JOB_ID';
const res = await fetch(`https://vibecode.bitrix24.com/v1/infra/servers/${encodeURIComponent(serverId)}/jobs/${encodeURIComponent(jobId)}/rotate-secret`, {
  method: 'POST',
  headers: {
    'X-Api-Key': 'YOUR_APP_KEY',
    'Authorization': 'Bearer USER_SESSION_TOKEN',
  },
});
const result = await res.json();
if (!res.ok || !result.success) throw new Error(result.error?.code ?? `HTTP_${res.status}`);
// Store result.data.secret in protected server-side configuration; never log it.
```

## Response fields

| Field | Type | Description |
|---|---|---|
| `success` | boolean | Always `true` on success |
| `data.secret` | string | New signing secret. Shown only in this response |

## Response example

`200 OK` response:

```json
{
  "success": true,
  "data": {
    "secret": "vjs_AAECAwQFBgcICQoLDA0ODxAREhMUFRYXGBkaGxwdHh8"
  }
}
```

## Error response example

404 — the job is missing, deleted or belongs to another server:

```json
{
  "success": false,
  "error": {
    "code": "NOT_FOUND",
    "message": "NOT_FOUND"
  }
}
```

## Errors

| HTTP | Code | Reason |
|---|---|---|
| 404 | `NOT_FOUND` | Server not found or inaccessible to the caller; `message` is `Server not found` |
| 404 | `NOT_FOUND` | The job is missing, deleted or belongs to another server; `message` is `NOT_FOUND` |
| 404 | `FEATURE_DISABLED` | The feature is unavailable to this portal |
| 401 | `MISSING_API_KEY` | Missing API key |
| 403 | `INFRA_FORBIDDEN_FOR_COWORK_KEY` | A Cowork key cannot write infrastructure. Use a [deployment key](../../cowork/deploy-key.md) |
| 403 | `INFRA_SCOPE_REQUIRED` | The key lacks the `vibe:infra` scope |
| 403 | `WRITE_BLOCKED_READONLY_KEY` | A read-only key cannot write |
| 403 | `SERVER_ROLE_FORBIDDEN` | The development team role does not permit this action |
| 429 | `RATE_LIMITED` | The job mutation limit is exceeded: 10 per minute platform-wide. The effective value for the key is in the `x-ratelimit-limit` header, as the cap is divided across replicas. Shared API limits also apply |

Full list of shared error codes — [Errors](/docs/errors).

## See also

- [Create a job](./create.md)
- [List jobs](./list.md)
- [Replace job settings](./update.md)