Rensei docs
API ReferenceWorker Protocol

Trigger credential rotation fan-out

Called by the operator (CLI or admin UI) after rotating an upstream credential (Vault, 1Password, encrypted DB row, …). Re-resolves the `(orgId, kind)` tuple via the credential provider registry and fans the fresh value out to every live `rotate-stream` SSE subscriber for that org. Zero live subscribers is not an error. Auth: `Bearer rsk_*` via `getCliOrSessionAuth`. The `orgId` in the body must match the authenticated org. For `session` / `user_token` auth the caller must have `admin` or `owner` role; for `api_key` auth the cross-tenant guard is sufficient. The audit write is deferred (`after()`) and failures are non-fatal - the fan-out already fired.

POST
/api/daemon/credentials/rotate

Authorization

rsk_Bearer
headerAuthorizationBearer <rsk_live_*>

Rensei API key presented as Authorization: Bearer rsk_live_. Required API-key scopes are recorded per operation in x-rensei-required-scopes.

Request Body

application/json
  1. body
orgId*string

Must match the authenticated org.

kind*string

Credential kind (e.g. 'anthropic', 'linear', 'jira').

Response Body

Rotation fan-out complete.

application/json
  1. response
ok*true
Value intrue
kind*string
sessionCount*integer

Number of live SSE sessions that received the emit.

rotatedAt*string
Formatdate-time
Example Request
curl -X POST 'https://app.rensei.ai/api/daemon/credentials/rotate' \  -H 'Content-Type: application/json' \  -d '{  "orgId": "string",  "kind": "string"}'
Example Response
{  "ok": true,  "kind": "string",  "sessionCount": 0,  "rotatedAt": "2019-08-24T14:15:22Z"}

Append an immutable collection schema version

Append an immutable collection schema version - Rensei REST API operation reference.

SSE stream for credential rotation events

Runtime-worker-JWT-only Server-Sent Events endpoint. Requires `worker:session`. Before any credential read or subscription, the platform resolves the canonical secret-release scope from the active worker row and claimed session: JWT worker (`sub`), org, and project claims must exactly match the active worker; the session must be owned by that worker in the same org/project scope. Missing or mismatched ownership is collapsed to 404. The stream fails closed: authentication, canonical scope resolution, credential-gate evaluation, initial snapshot materialization/filtering, and rotation subscription registration all complete before `text/event-stream` is returned. It emits `INITIAL`, then filtered `UPDATE` events when an upstream OAuth rotation occurs, plus heartbeat events. Dependency failures return 503 instead of opening a partial stream.