RotateAdapterServiceAccountSecret
Rotates the client secret of an adapter's pipeline service account. The previous secret stops working immediately, and the adapter's pipelines / data flows must be redeployed afterwards before the new secret takes effect.
Examples
Rotate the secret (prompts for confirmation):
octo-cli -c RotateAdapterServiceAccountSecret -id "69cfa838092b710403248acd"
Skip the confirmation prompt (CI/automation):
octo-cli -c RotateAdapterServiceAccountSecret -id "69cfa838092b710403248acd" -y
Options
| Short | Long | Required | Description |
|---|---|---|---|
-id | --identifier | yes | The adapter runtime ID |
-y | --yes | no | Skip confirmation prompt |
Notes
Destructive: the previous secret is invalidated immediately. If the call fails, the previous secret remains in effect — the controller says so explicitly.
Redeploy the adapter's pipelines / data flows afterwards (DeployDataFlow / DeployPipeline). The adapter caches the credentials at pipeline registration and never refreshes them, so until then every pipeline still presents the old secret.
The secret itself is never returned — it lives only in the tenant's service-account configuration entity and in the identity client's hash.
A blueprint cannot rotate a live secret: the secret attribute is runtime state, so blueprint import/export deliberately leaves it alone. This command is the supported path.