Prepare Client Secret Rotation
POST
clients/{id}/secret:prepare
Prepare to regenerate the client secret. In response to a signed assertion from the client, a new client secret is generated and returned. The client must then call Commit Secret Rotation to activate the new secret.
If a client secret regeneration is already in progress, an attempt to prepare a new client secret will fail with a 409 status.
A prepared client secret that is not committed within 7 days will be discarded.
Users may only rotate their own client secrets; in other words the access token used to authorize this operation must be issued to the application itself.
Resource Information
| Method and URI | POST https://developer.api.autodesk.com/applications/v1/clients/{id}/secret:prepare |
| Authentication Context | app only |
| Required OAuth Scopes | application:client:rotate_secret |
| Data Format | JSON |
Request
Headers
| Authorization* string | Must be Bearer <token>, where <token> is obtained via OAuth |
| Content-Type* string | Must be application/json |
* Required
Request
URI Parameters
| id string | The client ID of the application to prepare for secret rotation.
Note: An application can only rotate its own client secret. It cannot rotate the client secret of another application. |
Request
Body Structure
| clientAssertion* string | A JWT signed by the application. The assertion must be signed by one of the keys published at the application’s JWKS URI. The supported signature algorithms are ES256, ES384, ES512, PS256, PS384, and PS512. The JWKS URI can be configured on https://aps.autodesk.com/myapps.
The JWT must contain the following claims:
|
* Required
Response
HTTP Status Code Summary
| 200 OK | Successfully prepared a new client secret. |
| 400 Bad Request | Malformed request. The request body is not valid. See response for details. |
| 401 Unauthorized | The request did not have a valid access token. Obtain a fresh access token and try again. |
| 403 Forbidden | You do not have permission to perform the operation specified by the request. |
| 404 Not Found | Not Found |
| 409 Conflict | Client secret regeneration is already in progress. |
Response
Body Structure (200)
| newSecret string | The new client secret. This secret won’t become active until Commit Secret Rotation is called.
Max length: 200 |
| expiresAt datetime: ISO 8601 | The date and time the prepared client secret for this application will expire. |
Example
Successfully prepared a new client secret.
Request
curl -v 'https://developer.api.autodesk.com/applications/v1/clients/:id/secret:prepare' \
-X 'POST' \
-H 'Authorization: Bearer AuIPTf4KYLTYGVnOHQ0cuolwCW2a' \
-H 'Content-Type: application/json' \
-d '{
"clientAssertion": "eyJ..."
}'
Response
{
"newSecret": "EsJi82aOhMfBAjia",
"expiresAt": "2019-01-01T00:00:00Z"
}
