RotateServiceAccountSecretResultDto

Namespace: Meshmakers.Octo.Communication.Contracts.DataTransferObjects

Answer of POST {tenantId}/v1/adapter/{adapterRtId}/serviceAccount/rotateSecret (AB#5032, client surface AB#5048) — the mirror of the communication controller's RotateServiceAccountSecretResultDto.

public record RotateServiceAccountSecretResultDto : IEquatable<RotateServiceAccountSecretResultDto>

Inheritance Object → RotateServiceAccountSecretResultDto
Implements IEquatable<RotateServiceAccountSecretResultDto>

Remarks:

🔴 It deliberately carries no secret, and adding one here would defeat the decision taken server-side: the plaintext lives in exactly two places — the tenant's ServiceAccountConfiguration entity and the identity client's hash — and a third copy travelling back through the SDK would end up in proxy logs, shell history and CI output. Everything a caller needs in order to act is in RotateServiceAccountSecretResultDto.RequiresPipelineRedeploy and RotateServiceAccountSecretResultDto.Message.

Properties

ClientId

The identity client whose secret was replaced.

public string ClientId { get; set; }

Property Value

String

ConfigurationWellKnownName

RtWellKnownName of the configuration entity holding the new secret — the key the mesh adapter resolves its execution identity by.

public string ConfigurationWellKnownName { get; set; }

Property Value

String

WasCreated

true when the adapter had no service account yet and the call provisioned one instead of rotating. Nothing was invalidated in that case.

public bool WasCreated { get; set; }

Property Value

Boolean

RequiresPipelineRedeploy

true when the adapter's pipelines / data flows must be redeployed before the new secret takes effect — the adapter caches the credentials in the pipeline's GlobalConfiguration at registration time and never refreshes them. A caller that drops this flag produces the "rotation done, still broken" situation.

public bool RequiresPipelineRedeploy { get; set; }

Property Value

Boolean

Message

Operator-facing summary, including the redeploy instruction when one is needed.

public string Message { get; set; }

Property Value

String

Constructors

RotateServiceAccountSecretResultDto(String, String, Boolean, Boolean, String)

Answer of POST {tenantId}/v1/adapter/{adapterRtId}/serviceAccount/rotateSecret (AB#5032, client surface AB#5048) — the mirror of the communication controller's RotateServiceAccountSecretResultDto.

public RotateServiceAccountSecretResultDto(string ClientId, string ConfigurationWellKnownName, bool WasCreated, bool RequiresPipelineRedeploy, string Message)

Parameters

ClientId String
The identity client whose secret was replaced.

ConfigurationWellKnownName String
RtWellKnownName of the configuration entity holding the new secret — the key the mesh adapter resolves its execution identity by.

WasCreated Boolean
true when the adapter had no service account yet and the call provisioned one instead of rotating. Nothing was invalidated in that case.

RequiresPipelineRedeploy Boolean
true when the adapter's pipelines / data flows must be redeployed before the new secret takes effect — the adapter caches the credentials in the pipeline's GlobalConfiguration at registration time and never refreshes them. A caller that drops this flag produces the "rotation done, still broken" situation.

Message String
Operator-facing summary, including the redeploy instruction when one is needed.

Remarks:

🔴 It deliberately carries no secret, and adding one here would defeat the decision taken server-side: the plaintext lives in exactly two places — the tenant's ServiceAccountConfiguration entity and the identity client's hash — and a third copy travelling back through the SDK would end up in proxy logs, shell history and CI output. Everything a caller needs in order to act is in RotateServiceAccountSecretResultDto.RequiresPipelineRedeploy and RotateServiceAccountSecretResultDto.Message.