> ## Documentation Index
> Fetch the complete documentation index at: https://nevermined.ai/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# Rotate a WebSocket secret

> Issues a fresh plaintext secret for an existing secret record and immediately invalidates the previous value, terminating any live socket still using it. The new plaintext secret is returned ONCE and is never retrievable again. The caller may only rotate secrets they own. Requires a Nevermined API key. Requires active organization membership. Requires the organization to be on the Enterprise tier.



## OpenAPI

````yaml /api-reference/organizations-openapi.json post /organizations/{orgId}/realtime/secrets/{id}/rotate
openapi: 3.0.0
info:
  title: Nevermined Organizations API
  description: >-
    Manage a Nevermined organization programmatically — members, tiers, groups &
    budgets, treasury wallets, customers, webhooks, analytics, and
    agent-discovery surfaces.
  version: 1.0.0
  contact: {}
servers:
  - url: https://api.sandbox.nevermined.app/api/v1
    description: Sandbox
  - url: https://api.live.nevermined.app/api/v1
    description: Live
security: []
tags:
  - name: Organizations
    x-group: General
    description: Organization settings, members & roles, and workspace context.
  - name: Organizations - Billing
    x-group: Billing
    description: Tiers, subscriptions, invoices, checkout, and the public tier catalog.
  - name: Groups
    x-group: Groups & Budgets
    description: Organization groups, per-group budgets, and shared payment methods.
  - name: Organizations - Wallets
    x-group: Wallets
    description: Custodial stablecoin treasury wallets.
  - name: Organizations - Customers
    x-group: Customers
    description: The white-label customer CRM (Enterprise).
  - name: Organizations - Analytics
    x-group: Analytics
    description: Revenue, MRR, usage, conversion, and per-member metrics.
  - name: Organizations - Webhooks
    x-group: Webhooks
    description: Outbound webhook subscriptions and deliveries.
  - name: Organizations - Activity
    x-group: Activity
    description: The organization activity feed.
  - name: Organizations - Realtime
    x-group: Realtime
    description: Realtime WebSocket secret management (Enterprise).
  - name: Invitations
    x-group: Invitations
    description: Invite people to an organization.
  - name: Organizations - Integration
    x-group: Agent Discovery
    description: >-
      Public agent-discovery surfaces (llms.txt, agentic-instructions.md,
      ai-catalog.json).
paths:
  /organizations/{orgId}/realtime/secrets/{id}/rotate:
    post:
      tags:
        - Organizations - Realtime
      summary: Rotate a WebSocket secret
      description: >-
        Issues a fresh plaintext secret for an existing secret record and
        immediately invalidates the previous value, terminating any live socket
        still using it. The new plaintext secret is returned ONCE and is never
        retrievable again. The caller may only rotate secrets they own. Requires
        a Nevermined API key. Requires active organization membership. Requires
        the organization to be on the Enterprise tier.
      operationId: RealtimeSecretsController_rotate
      parameters:
        - name: orgId
          required: true
          in: path
          description: Organization ID
          schema:
            type: string
            example: org-abc123
        - name: id
          required: true
          in: path
          description: Identifier of the WebSocket secret to rotate
          schema:
            example: rts-3f2b8c1d
            type: string
      responses:
        '201':
          description: >-
            New plaintext secret returned once; the old secret is immediately
            revoked
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/WsSecretResponseDto'
        '401':
          description: Missing or invalid Nevermined API key
        '403':
          description: >-
            Caller is not a member of the organization, or the org is not on the
            Enterprise tier
        '404':
          description: Secret not found or not owned by the caller
      security:
        - Authorization: []
components:
  schemas:
    WsSecretResponseDto:
      type: object
      properties:
        id:
          type: string
          example: rts-3f2b…
        label:
          type: string
          example: MacBook ops
        secret:
          type: string
          description: >-
            Plaintext secret — shown ONCE. Copy it now; it is never retrievable
            again.
          example: wss_J8x…
        lastFour:
          type: string
          description: Last 4 chars (the dashboard masks it as wss_…XXXX).
          example: a1B2
        createdAt:
          format: date-time
          type: string
      required:
        - id
        - label
        - secret
        - lastFour
        - createdAt
  securitySchemes:
    Authorization:
      scheme: bearer
      bearerFormat: JWT
      type: http

````

## Related topics

- [Revoke a WebSocket secret](/docs/api-reference/organizations--realtime/revoke-a-websocket-secret.md)
- [Generate a WebSocket secret](/docs/api-reference/organizations--realtime/generate-a-websocket-secret.md)
- [List the caller's own WebSocket secrets](/docs/api-reference/organizations--realtime/list-the-callers-own-websocket-secrets.md)
- [Activity & Events](/docs/solutions/organizations/activity-and-events.md)
- [Rotate a webhook signing secret](/docs/api-reference/organizations--webhooks/rotate-a-webhook-signing-secret.md)