Rensei docs
API ReferenceWorker Protocol

Trigger credential rotation fan-out

Called by the operator (CLI or admin UI) after rotating an upstream credential (Vault, 1Password, encrypted DB row, …). Re-resolves the `(orgId, kind)` tuple via the credential provider registry and fans the fresh value out to every live `rotate-stream` SSE subscriber for that org. Zero live subscribers is not an error. Auth: `Bearer rsk_*` via `getCliOrSessionAuth`. The `orgId` in the body must match the authenticated org. For `session` / `user_token` auth the caller must have `admin` or `owner` role; for `api_key` auth the cross-tenant guard is sufficient. The audit write is deferred (`after()`) and failures are non-fatal - the fan-out already fired.

POST
/api/daemon/credentials/rotate

Authorization

rsk_Bearer
AuthorizationBearer <token>

Rensei API key presented as Authorization: Bearer rsk_live_. Required API-key scopes are recorded per operation in x-rensei-required-scopes.

In: header

Request Body

application/json

TypeScript Definitions

Use the request body type in TypeScript.

Response Body

application/json

application/json

application/json

application/json

application/json

application/json

curl -X POST "https://example.com/api/daemon/credentials/rotate" \  -H "Content-Type: application/json" \  -d '{    "orgId": "string",    "kind": "string"  }'
{
  "ok": true,
  "kind": "string",
  "sessionCount": 0,
  "rotatedAt": "2019-08-24T14:15:22Z"
}
{
  "error": "Session not found"
}
{
  "error": "Session not found"
}
{
  "error": "Session not found"
}
{
  "error": "Session not found"
}
{
  "error": "Session not found"
}

List the organizations (workspaces) the authenticated principal belongs to.

List the organizations (workspaces) the authenticated principal belongs to. - Rensei REST API operation reference.

SSE stream for credential rotation events

Runtime-worker-JWT-only Server-Sent Events endpoint. Requires `worker:session`. Before any credential read or subscription, the platform resolves the canonical secret-release scope from the active worker row and claimed session: JWT worker (`sub`), org, and project claims must exactly match the active worker; the session must be owned by that worker in the same org/project scope. Missing or mismatched ownership is collapsed to 404. The stream fails closed: authentication, canonical scope resolution, credential-gate evaluation, initial snapshot materialization/filtering, and rotation subscription registration all complete before `text/event-stream` is returned. It emits `INITIAL`, then filtered `UPDATE` events when an upstream OAuth rotation occurs, plus heartbeat events. Dependency failures return 503 instead of opening a partial stream.