Rotate a vault token

Rotate a vault’s stored service account token, keeping its ID and settings.

PUT /api/v2/vaults/{vault_id}/token

Python

from hai_agents import Client

client = Client()

client.vaults.rotate_vault_token(
    vault_id=vault_id,
    token="ops_newtoken...",
)

Behavior

The service account token travels in clear text inside the body. Send it only over HTTPS and never log the request. Rotation is not idempotent: a retry after a 5xx may apply twice.

The new token is health-checked against the provider before it is written, so a token that cannot reach op_vault_id is rejected and the old one stays in place. An H-hosted vault has no token to rotate.

Path parameters

vault_id · string · required

The vault config’s id (UUID).

Request body

token · string · required

The new 1Password service account token. Write-only and never returned.

Response

204 No Content.

Python

from hai_agents import Client

client = Client()

client.vaults.rotate_vault_token(
    vault_id=vault_id,
    token="ops_newtoken...",
)

Errors

Status	Cause
400	The provider rejected the new token (the stored token is unchanged), or the vault is H-hosted and has no token.
404	Not found, or not in your organization.
422	Body failed validation.