لوكلاء AI: ملف markdown لهذه الصفحة — /docs-content-en/infra/jobs/rotate-secret.md فهرس التوثيق — /llms.txt

مقالات التوثيق متاحة حاليًا باللغة الإنجليزية فقط.

Rotate the secret

POST /v1/infra/servers/:id/jobs/:jobId/rotate-secret

Rotates the signing secret and shows its new value once. The feature must be available; the enabled value is not changed. The next attempt uses the new secret, while a request already sent may be signed with the old one. On the app side, keep the previous secret for 5 minutes or accept that those requests are rejected. Your app's 401 and 403 responses are final: rotating the secret does not resend those requests.

Requires a key with vibe:infra and existing permissions on the server. Writes need the managing key or a development team role permitted to manage the lifecycle. General rules: Scheduled HTTP calls. Request verification in the handler: Verify signatures.

Parameters

Parameter In Type Required Description
Parameterid Inpath Typestring Requiredyes DescriptionServer ID from the server list
ParameterjobId Inpath Typestring Requiredyes DescriptionJob ID from the job list

No request body or query parameters are needed.

Examples

curl — personal key

Terminal 
curl --max-time 20 -X POST "https://vibecode.bitrix24.com/v1/infra/servers/SERVER_ID/jobs/JOB_ID/rotate-secret" \
  -H "X-Api-Key: YOUR_API_KEY"

curl — OAuth application

Terminal 
curl --max-time 20 -X POST "https://vibecode.bitrix24.com/v1/infra/servers/SERVER_ID/jobs/JOB_ID/rotate-secret" \
  -H "X-Api-Key: YOUR_APP_KEY" \
  -H "Authorization: Bearer USER_SESSION_TOKEN"

JavaScript — personal key

javascript 
const serverId = 'SERVER_ID';
const jobId = 'JOB_ID';
const res = await fetch(`https://vibecode.bitrix24.com/v1/infra/servers/${encodeURIComponent(serverId)}/jobs/${encodeURIComponent(jobId)}/rotate-secret`, {
  method: 'POST',
  headers: {
    'X-Api-Key': 'YOUR_API_KEY',
  },
});
const result = await res.json();
if (!res.ok || !result.success) throw new Error(result.error?.code ?? `HTTP_${res.status}`);
// Store result.data.secret in protected server-side configuration; never log it.

JavaScript — OAuth application

javascript 
const serverId = 'SERVER_ID';
const jobId = 'JOB_ID';
const res = await fetch(`https://vibecode.bitrix24.com/v1/infra/servers/${encodeURIComponent(serverId)}/jobs/${encodeURIComponent(jobId)}/rotate-secret`, {
  method: 'POST',
  headers: {
    'X-Api-Key': 'YOUR_APP_KEY',
    'Authorization': 'Bearer USER_SESSION_TOKEN',
  },
});
const result = await res.json();
if (!res.ok || !result.success) throw new Error(result.error?.code ?? `HTTP_${res.status}`);
// Store result.data.secret in protected server-side configuration; never log it.

Response fields

Field Type Description
Fieldsuccess Typeboolean DescriptionAlways true on success
Fielddata.secret Typestring DescriptionNew signing secret. Shown only in this response

Response example

200 OK response:

JSON 
{
  "success": true,
  "data": {
    "secret": "vjs_AAECAwQFBgcICQoLDA0ODxAREhMUFRYXGBkaGxwdHh8"
  }
}

Error response example

404 — the job is missing, deleted or belongs to another server:

JSON 
{
  "success": false,
  "error": {
    "code": "NOT_FOUND",
    "message": "NOT_FOUND"
  }
}

Errors

HTTP Code Reason
HTTP404 CodeNOT_FOUND ReasonServer not found or inaccessible to the caller; message is Server not found
HTTP404 CodeNOT_FOUND ReasonThe job is missing, deleted or belongs to another server; message is NOT_FOUND
HTTP404 CodeFEATURE_DISABLED ReasonThe feature is unavailable to this portal
HTTP401 CodeMISSING_API_KEY ReasonMissing API key
HTTP403 CodeINFRA_FORBIDDEN_FOR_COWORK_KEY ReasonA Cowork key cannot write infrastructure. Use a deployment key
HTTP403 CodeINFRA_SCOPE_REQUIRED ReasonThe key lacks the vibe:infra scope
HTTP403 CodeWRITE_BLOCKED_READONLY_KEY ReasonA read-only key cannot write
HTTP403 CodeSERVER_ROLE_FORBIDDEN ReasonThe development team role does not permit this action
HTTP429 CodeRATE_LIMITED ReasonThe job mutation limit is exceeded: 10 per minute platform-wide. The effective value for the key is in the x-ratelimit-limit header, as the cap is divided across replicas. Shared API limits also apply

Full list of shared error codes — Errors.

See also