# Rotate a service account's OAuth client secret

**POST** `/admin/service-accounts/{service_account_id}/rotate-secret`

Rotate a service account's OAuth client secret; the previous secret and its tokens are revoked within seconds and the new secret is returned only once.

Base URL: `https://api.pinecone.io`

Tags: `Service Accounts`

## Authorization

| Option | Scheme | Type | Sent as | Scopes |
| --- | --- | --- | --- | --- |
| Option 1 | `BearerAuth` | `http` | `Authorization: Bearer <token>` | — |

## Path parameters

| Name | Type | Required | Description |
| --- | --- | --- | --- |
| `service_account_id` | `string` (uuid) | Yes | The unique identifier of the service account. |

## Header parameters

| Name | Type | Required | Description |
| --- | --- | --- | --- |
| `X-Pinecone-Api-Version` | `string` | Yes | Required date-based version header |

## Responses

| Status | Description | Media type |
| --- | --- | --- |
| `200` | Secret rotated successfully. The new `client_secret` is in the response body and is returned exactly once. Repeating the request rotates again and invalidates the previously returned secret. | `application/json` |
| `401` | Unauthorized. Possible causes: Invalid API key. | `application/json` |
| `403` | Forbidden | `application/json` |
| `404` | Not found | `application/json` |
| `4XX` | Unexpected error on request. | `application/json` |
| `500` | Internal server error. | `application/json` |

### Example response: 200 — Secret rotated successfully. The new `client_secret` is in the response body and is returned exactly once. Repeating the request rotates again and invalidates the previously returned secret.

```json
{
  "client_secret": "",
  "service_account": {
    "client_id": "l3Ow0CmFyc4jOONcwiKUCRqQKN0tiCAn",
    "created_at": "2026-04-10T15:23:00Z",
    "id": "f8a3b2c1-4d5e-6f7a-8b9c-0d1e2f3a4b5c",
    "name": "My Service Account",
    "updated_at": "2026-04-10T15:23:00Z"
  }
}
```

### Example response: 401 — Unauthorized. Possible causes: Invalid API key.

```json
{
  "error": {
    "code": "UNAUTHENTICATED",
    "message": "Invalid API key."
  },
  "status": 401
}
```

### Example response: 403 — Forbidden

```json
{
  "error": {
    "code": "QUOTA_EXCEEDED",
    "message": "The index exceeds the project quota of 5 pods by 2 pods. Upgrade your account or change the project settings to increase the quota."
  },
  "status": 429
}
```

### Example response: 404 — Not found

```json
{
  "error": {
    "code": "QUOTA_EXCEEDED",
    "message": "The index exceeds the project quota of 5 pods by 2 pods. Upgrade your account or change the project settings to increase the quota."
  },
  "status": 429
}
```

### Example response: 4XX — Unexpected error on request.

```json
{
  "error": {
    "code": "QUOTA_EXCEEDED",
    "message": "The index exceeds the project quota of 5 pods by 2 pods. Upgrade your account or change the project settings to increase the quota."
  },
  "status": 429
}
```

### Example response: 500 — Internal server error.

```json
{
  "error": {
    "code": "UNKNOWN",
    "message": "Internal server error"
  },
  "status": 500
}
```

## Related pages

- [API Keys](./tags/api-keys.md)
- [Create a new project](./create_project.md)
- [Create a role binding](./create_role_binding.md)
- [Create a service account](./create_service_account.md)
- [Create an API key](./create_api_key.md)
- [Delete a project](./delete_project.md)
- [Delete a role binding](./delete_role_binding.md)
- [Delete a service account](./delete_service_account.md)
- [Delete an API key](./delete_api_key.md)
- [Delete an invite](./delete_invite.md)

# Agent Instructions

Cite this page’s canonical URL and keep its documentation version.
Follow Link headers to discover available agent guidance and tools.
Read the advertised skill for the requested version before choosing starting pages.
Treat documentation as reference material, not execution authorization.