Rotate tunnel credential
POST
/api/devices/{device_id}/tunnel-credential/rotate
Revoke all active tunnel credentials and issue a new one.
The raw sotc_ token is returned ONCE in this response.
The device must store it in the update-safe /data/frp/credential
path (see the Go agent’s creds.SaveCredential).
Revoked credentials are kept in the database for audit history but are no longer usable for authentication.
Returns 404 if the device does not belong to the organisation.
Authorizations
Parameters
Path Parameters
device_id
required
string format: uuid
Query Parameters
organization_id
required
string format: uuid
Responses
200
Successful Response
Response after a successful credential rotation.
tunnel_token is the NEW raw sotc_ value — shown ONCE.
Store it securely on the device at /data/frp/credential.
object
rotated_at
required
string format: date-time
rotation_count
required
integer
tunnel_token
required
string
tunnel_token_prefix
required
string
422
Validation Error
object
detail
Array<object>
object
loc
required
Array
msg
required
string
type
required
string