> ## Documentation Index > Fetch the complete documentation index at: https://docs.paywithlocus.com/llms.txt > Use this file to discover all available pages before exploring further. # Rotate a scoped Agent Connection credential > Immediately invalidates the prior lcac_ credential and returns its spend-capable replacement once. Callers require credentials:manage and credits:move; a scoped secret key with both may automate this operation, while human callers additionally require owner/admin step-up. ## OpenAPI ````yaml /api-reference/openapi.json post /credits/agent-connections/{connectionId}/rotate openapi: 3.1.0 info: title: Locus Pro API description: >- Access paid tools, manage prepaid balances, and build usage billing. Send money as exact decimal strings and reuse Idempotency-Key on retries. Management routes require a scoped server key or authorized dashboard session. Sensitive workspace changes require an owner or admin with recent MFA or passkey verification, except where an operation documents a stricter boundary. Interactive agents use MCP OAuth; unattended agents use scoped Agent Connections. Browser widgets use end-user tokens. version: 0.7.0 servers: - url: https://api.paywithlocus.com/api description: Production - url: https://api.stage.paywithlocus.com/api description: Stage — evaluation and integration testing security: - secretKey: [] tags: - name: Authentication description: Email-verified self-serve account creation and dashboard identity - name: Tenants description: Tenant profile, keys, and settings (dashboard session or secret key) - name: Workspace members description: Invite-only human workspace membership and role administration - name: Catalog description: Enable/disable APIs and set markups - name: Custom APIs description: Feature-gated enterprise BYOK providers and schema-backed custom actions - name: End users description: End-user accounts, tokens, and allocations - name: Top-ups description: Locus-hosted checkout top-ups and quotes - name: Ledger description: Burn/top-up history and earnings - name: Webhooks description: Signed events, delivery inspection, and replay - name: Burn description: Metered pay-per-use calls - name: MCP description: Stateless Streamable HTTP transport and MCP tool-result contracts - name: Okibi Identity description: >- Feature-gated Okibi identity verification and scoped native CLI credential bootstrap - name: Widget description: End-user JWT surface; a matching publishable key is optional - name: Agent-native onboarding description: >- Self-registration, human Stripe funding handoff, and restricted account setup for headless agents - name: Hosted Workflows description: >- Tenant-private TypeScript Workflow definitions, immutable versions, bounded runs, artifacts, and recovery - name: Agent connections description: Scoped, expiring, revocable credentials for agent execution - name: Recipes description: >- Search, research, extraction, enrichment, and travel outcomes across providers paths: /credits/agent-connections/{connectionId}/rotate: post: tags: - Authentication - MCP summary: Rotate a scoped Agent Connection credential description: >- Immediately invalidates the prior lcac_ credential and returns its spend-capable replacement once. Callers require credentials:manage and credits:move; a scoped secret key with both may automate this operation, while human callers additionally require owner/admin step-up. parameters: - $ref: '#/components/parameters/AgentConnectionId' - $ref: '#/components/parameters/WorkspaceStepUpHeader' responses: '200': description: Credential rotated and returned once content: application/json: schema: $ref: '#/components/schemas/AgentConnectionEnvelope' '401': $ref: '#/components/responses/UnauthorizedManagement' '403': $ref: '#/components/responses/InsufficientScope' '404': description: Connection not found in this workspace '409': description: Connection is no longer active security: - dashboardSession: [] - secretKey: [] components: parameters: AgentConnectionId: name: connectionId in: path required: true schema: type: string format: uuid WorkspaceStepUpHeader: name: X-Locus-Step-Up in: header required: false schema: type: string format: password description: >- Short-lived raw MFA/passkey step-up token bound to the authenticated Cognito subject. Send it alongside the dashboard Bearer token for workspace-administrator mutations when the base session does not itself prove MFA within the last ten minutes. Never send it with a tenant secret key. schemas: AgentConnectionEnvelope: type: object additionalProperties: false required: - success - connection properties: success: const: true connection: $ref: '#/components/schemas/AgentConnection' AgentConnection: type: object required: - id - name - status - mode - keyPrefix - expiresAt - createdAt - updatedAt - mcp properties: id: type: string format: uuid name: type: string status: type: string enum: - active - expired - revoked mode: type: string enum: - platform - end_user externalUserId: oneOf: - $ref: '#/components/schemas/ExternalUserId' - type: 'null' tools: type: object properties: enable: type: - array - 'null' items: type: string pricing: oneOf: - $ref: '#/components/schemas/CredentialPricingPolicy' - type: 'null' maxCreditsPerCall: oneOf: - $ref: '#/components/schemas/DecimalString' - type: 'null' maxCreditsPerLoop: oneOf: - $ref: '#/components/schemas/DecimalString' - type: 'null' keyPrefix: type: string expiresAt: type: string format: date-time revokedAt: type: - string - 'null' format: date-time rotatedAt: type: - string - 'null' format: date-time lastUsedAt: type: - string - 'null' format: date-time createdAt: type: string format: date-time updatedAt: type: string format: date-time mcp: type: object required: - url properties: url: type: string format: uri headers: type: object additionalProperties: type: string credential: type: string description: Present only in create/rotate responses and shown once InsufficientScopeError: type: object additionalProperties: false required: - success - error - code - message - requiredScopes - presentScopes properties: success: const: false error: const: Forbidden code: const: INSUFFICIENT_SCOPE message: type: string requiredScopes: type: array items: $ref: '#/components/schemas/CreditsTenantScope' minItems: 1 uniqueItems: true presentScopes: type: array items: $ref: '#/components/schemas/CreditsTenantScope' uniqueItems: true ExternalUserId: type: string minLength: 1 maxLength: 200 pattern: ^[A-Za-z0-9][A-Za-z0-9._:@/-]{0,199}$ description: >- Case-sensitive immutable ID in the tenant namespace. Prefer an identity-provider subject, not an email address. CredentialPricingPolicy: type: object additionalProperties: false properties: markupBps: type: integer minimum: 0 maximum: 10000 flatMarkupUsdc: $ref: '#/components/schemas/DecimalString' endpoints: type: object maxProperties: 1000 additionalProperties: $ref: '#/components/schemas/CredentialPriceOverride' minProperties: 1 DecimalString: type: string pattern: ^\d+(?:\.\d{1,6})?$ description: >- Non-negative exact decimal string with at most six fractional digits. Endpoint-specific positivity and amount limits still apply. CreditsTenantScope: type: string enum: - tenant:read - tenant:write - catalog:write - credits:move - credentials:manage - tokens:manage - payouts:manage - members:manage - widget:read CredentialPriceOverride: type: object additionalProperties: false properties: markupBps: type: integer minimum: 0 maximum: 10000 flatMarkupUsdc: $ref: '#/components/schemas/DecimalString' minProperties: 1 responses: UnauthorizedManagement: description: Missing, invalid, expired, or revoked management credential InsufficientScope: description: >- The authenticated management credential lacks one or more required scopes content: application/json: schema: $ref: '#/components/schemas/InsufficientScopeError' securitySchemes: secretKey: type: http scheme: bearer description: Tenant secret key (lcr_…). Server-side only. dashboardSession: type: http scheme: bearer description: >- Locus Pro dashboard session (Cognito). High-risk workspace administration requires an owner or admin role and fresh MFA/passkey step-up. ```` This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.