> ## Documentation Index > Fetch the complete documentation index at: https://developer.hellgate.io/llms.txt > Use this file to discover all available pages before exploring further. # Rotate credentials ## OpenAPI ````yaml /products/link/openapi.yaml post /api/admin/backends/{id}/rotate-credentials openapi: 3.0.0 info: description: >- Admin API for managing Link protocols and backends (Bundled and Standalone editions). title: Link API version: '1.0' servers: - url: https://{instance}.{env}.on-hellgate.cloud description: Managed instance of Link variables: instance: default: my-instance description: Your unique instance slug, provided during onboarding. env: default: eu1 description: Deployment environment (currently eu1). security: [] tags: [] paths: /api/admin/backends/{id}/rotate-credentials: post: tags: - Backends summary: Rotate credentials operationId: backends_rotate_credentials parameters: - description: '' in: path name: id required: true schema: type: string requestBody: content: application/json: schema: $ref: '#/components/schemas/BackendCredentialsRotateRequest' description: Credential rotation required: true responses: '200': content: application/json: schema: $ref: '#/components/schemas/BackendDetail' description: Backend updated '401': content: application/json: schema: $ref: '#/components/schemas/Unauthorized' description: Unauthorized '403': content: application/json: schema: $ref: '#/components/schemas/Forbidden' description: Forbidden '404': content: application/json: schema: $ref: '#/components/schemas/NotFound' description: Not found '422': content: application/json: schema: $ref: '#/components/schemas/ValidationErrors' description: Validation error callbacks: {} security: - bearerAuth: [] components: schemas: BackendCredentialsRotateRequest: properties: credentials: $ref: '#/components/schemas/BackendCredentials' required: - credentials title: BackendCredentialsRotateRequest type: object BackendDetail: properties: auth_pipeline: $ref: '#/components/schemas/AuthPipeline' connections: example: assess.pan: endpoint: method: POST path: /v1/decisions content_type: application/json timeout_ms: 5000 request_mapping: body: cardNumber: '{{ $.request.body.credential.pan.value | required }}' amount: '{{ $.request.body.transaction.amount | required }}' currency: '{{ $.request.body.transaction.currency | required }}' response_mapping: '200': return: '200' body: type: enum value: >- {{ $.response.body.status | map({ ACCEPTED: ALLOW, REJECTED: BLOCK, PENDING: REVIEW }) | required }} backend_reference: '{{ $.response.body.id | omit_if_null }}' additionalProperties: $ref: '#/components/schemas/ConnectionConfig' description: Map of action keys to connection configurations type: object enabled: example: true type: boolean encryption: $ref: '#/components/schemas/EncryptionConfig' host: example: api.acme.example type: string id: example: acme-risk type: string inserted_at: example: '2026-05-12T09:30:00Z' format: date-time type: string name: example: Acme Risk type: string protocol: example: https://developer.hellgate.io/protocols/specter/v1 type: string title: BackendDetail type: object Unauthorized: description: No valid authentication was provided. example: classifier: UNAUTHORIZED code: 401 message: No valid means of authentication was provided properties: classifier: enum: - UNAUTHORIZED type: string code: enum: - 401 type: integer message: type: string required: - classifier - code - message title: Unauthorized type: object Forbidden: description: The token lacks the scope required for this operation. example: classifier: FORBIDDEN code: 403 message: Not allowed to access this resource or feature properties: classifier: enum: - FORBIDDEN type: string code: enum: - 403 type: integer message: type: string required: - classifier - code - message title: Forbidden type: object NotFound: description: The requested resource does not exist. example: classifier: NOT_FOUND code: 404 message: The requested resource does not exist properties: classifier: enum: - NOT_FOUND type: string code: enum: - 404 type: integer message: type: string required: - classifier - code - message title: NotFound type: object ValidationErrors: example: classifier: VALIDATION_ERROR code: 422 validation_errors: - message: must be a positive integer path: limit description: Response shape for request validation failures. properties: classifier: example: VALIDATION_ERROR type: string code: example: 422 type: integer validation_errors: items: properties: message: example: url is required type: string path: example: url nullable: true type: string type: object type: array required: - classifier - code - validation_errors title: ValidationErrors type: object BackendCredentials: description: >- Credential material for the auth pipeline. Shape is determined by `auth_pipeline.source_type` and `auth_pipeline.credential_type`. oneOf: - properties: password: example: YOUR_PROVIDER_PASSWORD type: string username: example: acme-api-user type: string required: - username - password title: InlineBasicCredentials type: object - properties: token: example: secret_key_test_... type: string required: - token title: InlineBearerCredentials type: object - properties: key_id: example: acme-key-1 type: string shared_secret: example: c2VjcmV0LXNpZ25pbmcta2V5 description: Base64-encoded secret type: string required: - key_id - shared_secret title: InlineHmacCredentials type: object - properties: vault_path: example: secret/data/credentials/acme-risk description: >- Vault KV v2 path, e.g. `secret/data/credentials/my-backend`. The secret must contain the inline credential fields for the chosen auth pipeline type. type: string required: - vault_path title: VaultCredentials type: object title: BackendCredentials AuthPipeline: description: >- How outbound requests to the provider are authenticated. An empty object (or omitting the pipeline) adds no authentication. A non-empty pipeline requires `source_type` and `credential_type`. example: source_type: inline credential_type: bearer token_prefix: token properties: credential_type: description: Authentication strategy enum: - hmac_sha256 - basic - bearer type: string date_header: example: Date description: Header name for the date value (`hmac_sha256` only) type: string extra_headers: example: x-client-id: acme-partner additionalProperties: type: string description: Additional headers appended to requests type: object header_values: example: x-api-key: YOUR_PROVIDER_API_KEY additionalProperties: type: string description: Static header values (`hmac_sha256` only) type: object method: example: POST description: >- HTTP method override for the signature (`hmac_sha256` only, default POST) type: string signed_headers: example: - date - digest description: >- Headers to include in the HMAC signature. Required when `credential_type` is `hmac_sha256`. items: type: string type: array source_type: description: >- Where the credentials come from — inline (encrypted at rest in the backend record) or a Vault pointer resolved at request time. enum: - inline - vault type: string token_prefix: example: token description: >- Token prefix for bearer auth (default: "Bearer", use "token" for Ravelin). `bearer` only. type: string required: - source_type - credential_type title: AuthPipeline type: object ConnectionConfig: description: >- Configuration for a single connection. Must have either mocks or live mapping (endpoint/request_mapping/response_mapping). properties: endpoint: example: method: POST path: /v1/decisions content_type: application/json timeout_ms: 5000 additionalProperties: true description: Live endpoint configuration type: object mocks: example: - match: {} respond: type: enum value: ALLOW description: Mock response definitions items: additionalProperties: true type: object type: array request_mapping: $ref: '#/components/schemas/RequestMapping' response_mapping: $ref: '#/components/schemas/ResponseMapping' title: ConnectionConfig type: object EncryptionConfig: description: >- Optional per-backend message-level encryption (MLE). When set, the mapped request body is JWE-encrypted before dispatch and the response body is decrypted before response mapping. Key material is managed via /api/admin/keys. nullable: true properties: algorithm: description: JWE key-management algorithm (JOSE `alg`). example: RSA-OAEP-256 type: string encryption_method: description: JWE content-encryption algorithm (JOSE `enc`). example: A256GCM type: string extra_header_claims: description: Additional JOSE header claims to include (currently supports `iat`). items: enum: - iat type: string type: array mode: description: >- Envelope mode. `whole_body` wraps the entire JSON body in `{request_field: }`. enum: - whole_body type: string request_field: description: >- Envelope field name for the outbound JWE (default `encryptedRequest`). example: encryptedRequest type: string request_key_kid: example: a1b2c3d4e5f6 description: '`kid` of an encryption key with purpose `encrypt_request`.' type: string response_field: description: >- Envelope field name for the inbound JWE (default `encryptedResponse`). example: encryptedResponse type: string response_key_kids: example: - f6e5d4c3b2a1 description: >- Ordered list of `kid`s (purpose `decrypt_response`) tried in order when decrypting responses. Allows rotation overlap. items: type: string type: array required: - mode - algorithm - encryption_method - request_key_kid - response_key_kids title: EncryptionConfig type: object RequestMapping: description: >- Template-shaped request mapping. Both `body` and `headers` carry template strings resolved against the caller's invoke body and headers at runtime. properties: body: example: amount: '{{ $.request.body.transaction.amount | required }}' currency: '{{ $.request.body.transaction.currency | required }}' additionalProperties: true description: > Recursive object mirroring the backend's expected request body. Leaves are plain JSON values: strings carry the mustache-style template grammar (`{{ $req.body.x | filter }}`), other primitives are literals. See `Link.Mapping.Parser` for the full grammar and filter catalogue. type: object headers: example: x-correlation-id: '{{ $.request.header.x-correlation-id | omit_if_null }}' additionalProperties: type: string description: > Outbound HTTP headers, keyed by header name. Each value is a template string that must resolve to a scalar coercible to a string. Auth-pipeline headers (HMAC `Digest`, etc.) override mapped headers on conflict. type: object title: RequestMapping type: object ResponseMapping: additionalProperties: properties: body: additionalProperties: true description: > Recursive template; leaves are plain JSON values where strings follow the mustache-style template grammar. Response templates may reference all four scoped roots: `$req.body.*`, `$req.header.*`, `$res.body.*`, and `$res.header.*`. type: object return: description: Protocol HTTP status code to return to the caller. type: string required: - return - body type: object description: >- Map of backend HTTP status patterns (`201`, `4xx`, `default`, ...) to response rules. Each rule has a `return` (the protocol HTTP status to return to the caller) and a `body` template that produces the protocol-shaped response. example: '200': return: '200' body: type: enum value: >- {{ $.response.body.status | map({ ACCEPTED: ALLOW, REJECTED: BLOCK }) | required }} backend_reference: '{{ $.response.body.id | omit_if_null }}' title: ResponseMapping type: object securitySchemes: bearerAuth: bearerFormat: JWT scheme: bearer type: http ````