Set or rotate a queue credential

curl --request PUT \
  --url https://streaming-hub.sandbox.lerian.net/v1/subscriptions/{id}/credential \
  --header 'Authorization: Bearer <token>' \
  --header 'Content-Type: application/json' \
  --data '
{
  "sinkConfig": {
    "uri": "amqps://user:pass@broker.example.com:5671/vhost"
  }
}
'

package main

import (
	"fmt"
	"strings"
	"net/http"
	"io"
)

func main() {

	url := "https://streaming-hub.sandbox.lerian.net/v1/subscriptions/{id}/credential"

	payload := strings.NewReader("{\n  \"sinkConfig\": {\n    \"uri\": \"amqps://user:pass@broker.example.com:5671/vhost\"\n  }\n}")

	req, _ := http.NewRequest("PUT", url, payload)

	req.Header.Add("Authorization", "Bearer <token>")
	req.Header.Add("Content-Type", "application/json")

	res, _ := http.DefaultClient.Do(req)

	defer res.Body.Close()
	body, _ := io.ReadAll(res.Body)

	fmt.Println(string(body))

}

const options = {
  method: 'PUT',
  headers: {Authorization: 'Bearer <token>', 'Content-Type': 'application/json'},
  body: JSON.stringify({sinkConfig: {uri: 'amqps://user:pass@broker.example.com:5671/vhost'}})
};

fetch('https://streaming-hub.sandbox.lerian.net/v1/subscriptions/{id}/credential', options)
  .then(res => res.json())
  .then(res => console.log(res))
  .catch(err => console.error(err));

import requests

url = "https://streaming-hub.sandbox.lerian.net/v1/subscriptions/{id}/credential"

payload = { "sinkConfig": { "uri": "amqps://user:pass@broker.example.com:5671/vhost" } }
headers = {
    "Authorization": "Bearer <token>",
    "Content-Type": "application/json"
}

response = requests.put(url, json=payload, headers=headers)

print(response.text)

{
  "outcome": "ok",
  "statusCode": 200,
  "errorClass": ""
}

{
  "type": "https://errors.lerian.studio/v1/not_found",
  "title": "Not Found",
  "status": 404,
  "detail": "subscription not found",
  "code": "not_found"
}

{
  "type": "https://errors.lerian.studio/v1/not_found",
  "title": "Not Found",
  "status": 404,
  "detail": "subscription not found",
  "code": "not_found"
}

"<string>"

{
  "type": "https://errors.lerian.studio/v1/not_found",
  "title": "Not Found",
  "status": 404,
  "detail": "subscription not found",
  "code": "not_found"
}

{
  "type": "https://errors.lerian.studio/v1/not_found",
  "title": "Not Found",
  "status": 404,
  "detail": "subscription not found",
  "code": "not_found"
}

{
  "type": "https://errors.lerian.studio/v1/not_found",
  "title": "Not Found",
  "status": 404,
  "detail": "subscription not found",
  "code": "not_found"
}

Set or rotate a queue credential

Sets or rotates the outbound credential for a queue subscription (sqs, rabbitmq, eventbridge) with probe-on-write: the candidate credential is held in memory, probed (connect + auth) immediately, and persisted encrypted only on probe success — a failed probe stores nothing. A successful probe sets verification_state to active: from pending_verification on the first write, and from degraded when a rotation fixes a destination that had started failing. It leaves the enabled flag exactly as it found it. The credential is write-only: it is supplied only here and is never returned, not even masked, on any read path. A classified probe failure is still a 200. This route is naturally idempotent and requires no X-Idempotency header.

PUT

subscriptions

{id}

credential

Set or rotate a queue credential

curl --request PUT \
  --url https://streaming-hub.sandbox.lerian.net/v1/subscriptions/{id}/credential \
  --header 'Authorization: Bearer <token>' \
  --header 'Content-Type: application/json' \
  --data '
{
  "sinkConfig": {
    "uri": "amqps://user:pass@broker.example.com:5671/vhost"
  }
}
'

package main

import (
	"fmt"
	"strings"
	"net/http"
	"io"
)

func main() {

	url := "https://streaming-hub.sandbox.lerian.net/v1/subscriptions/{id}/credential"

	payload := strings.NewReader("{\n  \"sinkConfig\": {\n    \"uri\": \"amqps://user:pass@broker.example.com:5671/vhost\"\n  }\n}")

	req, _ := http.NewRequest("PUT", url, payload)

	req.Header.Add("Authorization", "Bearer <token>")
	req.Header.Add("Content-Type", "application/json")

	res, _ := http.DefaultClient.Do(req)

	defer res.Body.Close()
	body, _ := io.ReadAll(res.Body)

	fmt.Println(string(body))

}

const options = {
  method: 'PUT',
  headers: {Authorization: 'Bearer <token>', 'Content-Type': 'application/json'},
  body: JSON.stringify({sinkConfig: {uri: 'amqps://user:pass@broker.example.com:5671/vhost'}})
};

fetch('https://streaming-hub.sandbox.lerian.net/v1/subscriptions/{id}/credential', options)
  .then(res => res.json())
  .then(res => console.log(res))
  .catch(err => console.error(err));

import requests

url = "https://streaming-hub.sandbox.lerian.net/v1/subscriptions/{id}/credential"

payload = { "sinkConfig": { "uri": "amqps://user:pass@broker.example.com:5671/vhost" } }
headers = {
    "Authorization": "Bearer <token>",
    "Content-Type": "application/json"
}

response = requests.put(url, json=payload, headers=headers)

print(response.text)

{
  "outcome": "ok",
  "statusCode": 200,
  "errorClass": ""
}

{
  "type": "https://errors.lerian.studio/v1/not_found",
  "title": "Not Found",
  "status": 404,
  "detail": "subscription not found",
  "code": "not_found"
}

{
  "type": "https://errors.lerian.studio/v1/not_found",
  "title": "Not Found",
  "status": 404,
  "detail": "subscription not found",
  "code": "not_found"
}

"<string>"

{
  "type": "https://errors.lerian.studio/v1/not_found",
  "title": "Not Found",
  "status": 404,
  "detail": "subscription not found",
  "code": "not_found"
}

{
  "type": "https://errors.lerian.studio/v1/not_found",
  "title": "Not Found",
  "status": 404,
  "detail": "subscription not found",
  "code": "not_found"
}

{
  "type": "https://errors.lerian.studio/v1/not_found",
  "title": "Not Found",
  "status": 404,
  "detail": "subscription not found",
  "code": "not_found"
}

Autorizaciones

Authorization

string

header

requerido

A bearer JWT issued by plugin-auth (lib-auth). The tenant identity is resolved from the validated token claims; the /v1 surface never reads a tenant from the body, path, or query. Machine callers obtain a token via the plugin-auth client-credentials flow. The /admin surface authorizes against an operator scope and carries no tenant context.

Parámetros de ruta

string<uuid>

requerido

The unique identifier of the subscription (UUIDv7).

Cuerpo

application/json

The queue-credential body. sinkConfig is a kind-specific, write-only object that is probed and, on success, stored encrypted. It is never returned on any read path.

sinkConfig

object

requerido

The candidate outbound credential for the queue kind. For rabbitmq, an object such as {"uri":"amqps://user:pass@broker.example.com:5671/vhost"}; for AWS kinds, the region and access material. Write-only — never logged or returned.

Ejemplo:

{
  "uri": "amqps://user:pass@broker.example.com:5671/vhost"
}

Respuesta

The probe ran; the body carries the classified result. On success the credential was persisted and the subscription is active; on a classified failure nothing was persisted.

The classified result of a synchronous probe (ping, verify, or credential write). A classified failure is still returned with HTTP 200 — the probe ran and produced a verdict. It carries no secret, endpoint, or detail string.

outcome

enum<string>

requerido

The classified verdict of a synchronous probe.

Opciones disponibles:

ok,

failed

statusCode

integer

requerido

The target's protocol status. For webhook probes, the HTTP status (0 when none applies, e.g. a transport error or a blocked endpoint). For queue-kind credential probes, always 0.

Ejemplo:

200

errorClass

string

requerido

A frozen taxonomy token classifying a failure. Empty on success.

Ejemplo:

""

Catálogo

Suscripciones

Entrega de eventos

Administración

Operacional

Manejo de errores

Set or rotate a queue credential

Autorizaciones

Parámetros de ruta

Cuerpo

Respuesta