Get a credential's rotation status

Reports where the credential’s latest recorded rotation has got to in each cluster linked to it, and whether the old value is safe to revoke: safe_to_revoke is true once every running cluster whose copy Ankra renders serves the new value, and blocking_clusters names the rest. Stopped, not_covered and platform_only clusters do not block it and are still listed; a not_covered cluster carries the command that updates its copy by hand. A credential with no recorded rotation is safe to revoke only when no cluster is linked to it. The answer carries no secret material. Requires credentials.read.

GET /api/v1/org/credentials/{credential_id}/propagation

Get a credential's rotation status

Python

import requests

url = "https://platform.ankra.app/api/v1/org/credentials/{credential_id}/propagation"

headers = {"Authorization": "Bearer <token>"}

response = requests.get(url, headers=headers)

print(response.text)

200

{
  "rotation_id": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
  "revision": 123,
  "rotated_at": "2023-11-07T05:31:56Z",
  "verified_at": "2023-11-07T05:31:56Z",
  "safe_to_revoke": true,
  "blocking_clusters": [
    {
      "cluster_id": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
      "cluster_name": "<string>",
      "state": "queued",
      "reason": "<string>",
      "remedy": "<string>"
    }
  ],
  "clusters": [
    {
      "cluster_id": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
      "cluster_name": "<string>",
      "coverage": "covered",
      "state": "queued",
      "reason": "<string>",
      "remedy": "<string>",
      "forced": true,
      "operation_id": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
      "rotated_at": "2023-11-07T05:31:56Z",
      "dispatched_at": "2023-11-07T05:31:56Z",
      "rendered_at": "2023-11-07T05:31:56Z"
    }
  ]
}

Authorizations

Authorization · string · header · required

Bearer authentication header of the form Bearer <token>, where <token> is your auth token.

Headers

authorization · string | null

x-ankra-organisation-id · string | null

Path Parameters

credential_id · string<uuid4> · required

Response

200

application/json

Rotation status resolved

Where a credential's latest recorded rotation has got to in every linked cluster. Carries no secret material.

rotation_id · string<uuid> | null · required

Null when no rotation of the credential was recorded.

revision · integer · required

The credential's secret revision.

rotated_at · string<date-time> | null · required

verified_at · string<date-time> | null · required

When the old value was last confirmed out of use; null while it is not safe to revoke.

safe_to_revoke · boolean · required

True when every running cluster whose copy Ankra renders serves the new value and no cluster is not_covered. A not_covered cluster blocks it, because the rotation does not rewrite that cluster's copy: it is listed in blocking_clusters with the command that updates the copy by hand. waiting_for_start and platform_only clusters do not block it and are still listed in clusters.

blocking_clusters · CredentialRotationBlockingCluster · object[] · required

Show child attributes

clusters · CredentialRotationClusterPropagation · object[] · required

Show child attributes