Rotates a role's API key.

v1.0.0

Any role can rotate its own API key. The name and password (for users) or current API key (for hosts and users) of the role must be provided via HTTP Basic Authorization.

To rotate another role's API key, you may provide your name and password (for users) or current API key (for hosts and users) via HTTP Basic Authorization with the request. Alternatively, you may provide your Conjur access token via the standard Conjur Authorization header.

The Basic authentication-compliant header is formed by:

Concatenating the role's name, a literal colon character ':', and the password or API key to create the authentication string.
Base64-encoding the authentication string.
Prefixing the authentication string with the scheme: Basic (note the required space).
Providing the result as the value of the Authorization HTTP header: Authorization: Basic <authentication string>.

Your HTTP/REST client probably provides HTTP basic authentication support. For example, curl and all of the Conjur client libraries provide this.

If using the Conjur Authorization header, its value should be set to Token token=<base64-encoded access token>.

Note that the body of the request must be the empty string.

Input

{
  "type": "object",
  "properties": {
    "account": {
      "type": "string",
      "description": "Conjur account name"
    },
    "role": {
      "type": "string",
      "description": "##### Kinds of roles:\n\n- User: one unique wonderful human\n- Host: a single logical machine (in the broad sense, not just physical)\n- Layer: a collection of hosts that have the same privileges\n- Group: a collection of users and groups that have the same privileges\n- Policy: a role which owns of a set of related object\n\nAny identifier included in the URL must be URL-encoded to be recognized by the Conjur API.\n\n##### Resource Identifiers:\n\n- `myapp-01` -> `myapp-01` (unchanged)\n- `alice@devops` -> `alice%40devops`\n- `prod/aws/db-password` -> `prod%2Faws%2Fdb-password`\n- `research+development` -> `research%2Bdevelopment`\n- `sales&marketing` -> `sales%26marketing`\n"
    }
  },
  "required": [
    "account"
  ],
  "additionalProperties": false
}

Output

{
  "type": "object",
  "additionalProperties": true
}