rotate_client_secret
Rotate a client's secret, permanently invalidating the old one. Preview with dry_run to avoid surprises; the acting client's own rotation is refused.
Instructions
[WRITE][risk=high] Rotate a client's secret. IRREVERSIBLE — the old secret is invalidated; only masked fingerprints are recorded/returned, never the value.
Refuses to rotate the client this tool authenticates as: that would revoke its own credential with no undo to fall back on — including under dry_run, which must report a refusal rather than preview a call that will be refused. Rotate that one from the admin console and re-store it with 'identity-aiops secret set'.
Every deployment using this client must be updated with the new secret (fetch it from the admin console over a trusted channel). Pass dry_run=True to preview.
Args: client_id: Client internal id, from list_clients. dry_run: If True, preview without rotating. target: IdP target name from config; omit for the default.
Input Schema
| Name | Required | Description | Default |
|---|---|---|---|
| target | No | ||
| dry_run | No | ||
| client_id | Yes |