Rotate a subscription signing secret
Rotates the subscription’s signing secret and returns the new once-shown secret plus the overlap window during which the previous secret still verifies. The console never stores the secret.
Partner route: the text above describes the tenant’s own route. Here the register id in the path names the fund or originador the partner acts for: it must be in the partner credential’s scope and registered under the caller’s tenant. The partner sees and manages only the subscriptions it created through this register’s routes: the party’s own subscriptions and any other partner’s answer 404, as a missing one does. A fundo the bancarizador deactivated is refused 403 FUNDO_PARTNER_DEACTIVATED until it is reactivated.
Authorizations
JWT bearer token issued by the identity provider.
Headers
Bearer token. A tenant route relays it to the streaming-hub as server-to-server auth.
Idempotency key, forwarded to the hub's idempotency middleware, which refuses this mutation without one.
Path Parameters
The fund's register id, as returned in the id field of GET /v1/consignado/fundos. It must be in the partner credential's scope.
"3f2504e0-4f89-41d3-9a0c-0305e82c3301"
Subscription id.

