Skip to main content
PUT
Set or rotate a queue credential

Authorizations

Authorization
string
header
required

A bearer JWT issued by plugin-auth (lib-auth). The tenant identity is resolved from the validated token claims; the /v1 surface never reads a tenant from the body, path, or query. Machine callers obtain a token via the plugin-auth client-credentials flow. The /admin surface authorizes against an operator scope and carries no tenant context.

Path Parameters

id
string<uuid>
required

The unique identifier of the subscription (UUIDv7).

Body

application/json

The queue-credential body. sinkConfig is a kind-specific, write-only object that is probed and, on success, stored encrypted. It is never returned on any read path.

sinkConfig
object
required

The candidate outbound credential for the queue kind. For rabbitmq, an object such as {"uri":"amqps://user:pass@broker.example.com:5671/vhost"}; for AWS kinds, the region and access material. Write-only — never logged or returned.

Example:

Response

The probe ran; the body carries the classified result. On success the credential was persisted and the subscription is active; on a classified failure nothing was persisted.

The classified result of a synchronous probe (ping, verify, or credential write). A classified failure is still returned with HTTP 200 — the probe ran and produced a verdict. It carries no secret, endpoint, or detail string.

outcome
enum<string>
required

The classified verdict of a synchronous probe.

Available options:
ok,
failed
statusCode
integer
required

The target's protocol status. For webhook probes, the HTTP status (0 when none applies, e.g. a transport error or a blocked endpoint). For queue-kind credential probes, always 0.

Example:

200

errorClass
string
required

A frozen taxonomy token classifying a failure. Empty on success.

Example:

""