BedrockAgentCoreControl / Client / rotate_payment_connector_credentials

rotate_payment_connector_credentials

BedrockAgentCoreControl.Client.rotate_payment_connector_credentials(**kwargs)

Replaces the service-managed credentials of a payment connector with newly issued credentials.

Use this operation only for payment connectors with a provisionMode of QUICK_CREATE. For payment connectors with a provisionMode of MANUAL, call UpdatePaymentCredentialProvider instead after rotating credentials with the payment provider directly.

The rotation finishes before the response is returned, and only one rotation runs at a time for a given payment connector. When it succeeds, the new credential is in effect and the payment connector stays in the READY state. When it fails, an error is returned, the payment connector and its existing credential are left unchanged, and you can retry the request.

Rotation replaces the credential on the connector’s credential provider, so every payment connector that uses that provider is affected. Replace any copy of the previous credential that you use outside AgentCore.

See also: AWS API Documentation

Request Syntax

response = client.rotate_payment_connector_credentials(
    paymentManagerId='string',
    paymentConnectorId='string',
    credentialsToRotate={
        'coinbaseCDP': {
            'secrets': [
                'API_KEY'|'WALLET_SECRET',
            ]
        }
    },
    clientToken='string'
)
Parameters:

  • paymentManagerId (string) –

    [REQUIRED]

    The unique identifier of the parent payment manager.

  • paymentConnectorId (string) –

    [REQUIRED]

    The unique identifier of the payment connector whose credentials you want to rotate.

  • credentialsToRotate (dict) –

    [REQUIRED]

    The credentials to rotate. Specify the member that matches the payment connector’s type. Each credential that you select is rotated independently.

    Note

    This is a Tagged Union structure. Only one of the following top level keys can be set: coinbaseCDP.

    • coinbaseCDP (dict) –

      The credentials to rotate for a Coinbase CDP payment connector.

      • secrets (list) – [REQUIRED]

        The secrets to rotate. Specify at least one value. Each secret that you specify is rotated independently.

        • API_KEY - The API key that the payment connector uses to call Coinbase CDP. Rotate it as routine maintenance, or if you suspect that it is compromised.

        • WALLET_SECRET - The wallet secret that signs transactions. Rotate it only if it is lost or compromised. Coinbase CDP allows one wallet secret per project, so it is replaced in place and signing can be briefly interrupted.

        • (string) –

  • clientToken (string) –

    A unique, case-sensitive identifier to ensure that the API request completes no more than one time. If you don’t specify this field, a value is randomly generated for you. If this token matches a previous request, the service ignores the request, but doesn’t return an error. For more information, see Ensuring idempotency.

    This field is autopopulated if not provided.

Return type:

dict

Returns:

Response Syntax

{
    'paymentConnectorId': 'string',
    'paymentManagerId': 'string',
    'lastUpdatedAt': datetime(2015, 1, 1),
    'status': 'CREATING'|'UPDATING'|'DELETING'|'READY'|'CREATE_FAILED'|'UPDATE_FAILED'|'DELETE_FAILED'|'AWS_MARKETPLACE_SUBSCRIPTION_REQUIRED'|'PENDING_AUTHENTICATION'|'PROVISIONING'|'AUTHENTICATION_EXPIRED'|'AUTHENTICATION_FAILED'
}

Response Structure

  • (dict) –

    • paymentConnectorId (string) –

      The unique identifier of the payment connector.

    • paymentManagerId (string) –

      The unique identifier of the parent payment manager.

    • lastUpdatedAt (datetime) –

      The timestamp when the payment connector was last updated, which is when the rotation completed.

    • status (string) –

      The current status of the payment connector, which is READY after a successful rotation.

Exceptions