Skip to main content

RotateServiceAccountSecretResultDto

Namespace: Meshmakers.Octo.Communication.Contracts.DataTransferObjects

Answer of POST {tenantId}/v1/adapter/{adapterRtId}/serviceAccount/rotateSecret (AB#5032, client surface AB#5048) — the mirror of the communication controller's RotateServiceAccountSecretResultDto.

public record RotateServiceAccountSecretResultDto : IEquatable<RotateServiceAccountSecretResultDto>

Inheritance Object → RotateServiceAccountSecretResultDto
Implements IEquatable<RotateServiceAccountSecretResultDto>

Remarks:

🔴 It deliberately carries no secret, and adding one here would defeat the decision taken server-side: the plaintext lives in exactly two places — the tenant's ServiceAccountConfiguration entity and the identity client's hash — and a third copy travelling back through the SDK would end up in proxy logs, shell history and CI output. Everything a caller needs in order to act is in RotateServiceAccountSecretResultDto.RequiresPipelineRedeploy and RotateServiceAccountSecretResultDto.Message.

Properties​

ClientId​

The identity client whose secret was replaced.

public string ClientId { get; set; }

Property Value​

String

ConfigurationWellKnownName​

RtWellKnownName of the configuration entity holding the new secret — the key the mesh adapter resolves its execution identity by.

public string ConfigurationWellKnownName { get; set; }

Property Value​

String

WasCreated​

true when the adapter had no service account yet and the call provisioned one instead of rotating. Nothing was invalidated in that case.

public bool WasCreated { get; set; }

Property Value​

Boolean

RequiresPipelineRedeploy​

true when the adapter's pipelines / data flows must be redeployed before the new secret takes effect — the adapter caches the credentials in the pipeline's GlobalConfiguration at registration time and never refreshes them. A caller that drops this flag produces the "rotation done, still broken" situation.

public bool RequiresPipelineRedeploy { get; set; }

Property Value​

Boolean

Message​

Operator-facing summary, including the redeploy instruction when one is needed.

public string Message { get; set; }

Property Value​

String

Constructors​

RotateServiceAccountSecretResultDto(String, String, Boolean, Boolean, String)​

Answer of POST {tenantId}/v1/adapter/{adapterRtId}/serviceAccount/rotateSecret (AB#5032, client surface AB#5048) — the mirror of the communication controller's RotateServiceAccountSecretResultDto.

public RotateServiceAccountSecretResultDto(string ClientId, string ConfigurationWellKnownName, bool WasCreated, bool RequiresPipelineRedeploy, string Message)

Parameters​

ClientId String
The identity client whose secret was replaced.

ConfigurationWellKnownName String
RtWellKnownName of the configuration entity holding the new secret — the key the mesh adapter resolves its execution identity by.

WasCreated Boolean
true when the adapter had no service account yet and the call provisioned one instead of rotating. Nothing was invalidated in that case.

RequiresPipelineRedeploy Boolean
true when the adapter's pipelines / data flows must be redeployed before the new secret takes effect — the adapter caches the credentials in the pipeline's GlobalConfiguration at registration time and never refreshes them. A caller that drops this flag produces the "rotation done, still broken" situation.

Message String
Operator-facing summary, including the redeploy instruction when one is needed.

Remarks:

🔴 It deliberately carries no secret, and adding one here would defeat the decision taken server-side: the plaintext lives in exactly two places — the tenant's ServiceAccountConfiguration entity and the identity client's hash — and a third copy travelling back through the SDK would end up in proxy logs, shell history and CI output. Everything a caller needs in order to act is in RotateServiceAccountSecretResultDto.RequiresPipelineRedeploy and RotateServiceAccountSecretResultDto.Message.