Set or rotate a queue credential

curl --request PUT \
  --url https://streaming-hub.sandbox.lerian.net/v1/subscriptions/{id}/credential \
  --header 'Authorization: Bearer <token>' \
  --header 'Content-Type: application/json' \
  --data '
{
  "sinkConfig": {
    "uri": "amqps://user:pass@broker.example.com:5671/vhost"
  }
}
'

package main

import (
	"fmt"
	"strings"
	"net/http"
	"io"
)

func main() {

	url := "https://streaming-hub.sandbox.lerian.net/v1/subscriptions/{id}/credential"

	payload := strings.NewReader("{\n  \"sinkConfig\": {\n    \"uri\": \"amqps://user:pass@broker.example.com:5671/vhost\"\n  }\n}")

	req, _ := http.NewRequest("PUT", url, payload)

	req.Header.Add("Authorization", "Bearer <token>")
	req.Header.Add("Content-Type", "application/json")

	res, _ := http.DefaultClient.Do(req)

	defer res.Body.Close()
	body, _ := io.ReadAll(res.Body)

	fmt.Println(string(body))

}

const options = {
  method: 'PUT',
  headers: {Authorization: 'Bearer <token>', 'Content-Type': 'application/json'},
  body: JSON.stringify({sinkConfig: {uri: 'amqps://user:pass@broker.example.com:5671/vhost'}})
};

fetch('https://streaming-hub.sandbox.lerian.net/v1/subscriptions/{id}/credential', options)
  .then(res => res.json())
  .then(res => console.log(res))
  .catch(err => console.error(err));

import requests

url = "https://streaming-hub.sandbox.lerian.net/v1/subscriptions/{id}/credential"

payload = { "sinkConfig": { "uri": "amqps://user:pass@broker.example.com:5671/vhost" } }
headers = {
    "Authorization": "Bearer <token>",
    "Content-Type": "application/json"
}

response = requests.put(url, json=payload, headers=headers)

print(response.text)

{
  "outcome": "ok",
  "statusCode": 200,
  "errorClass": ""
}

{
  "type": "https://errors.lerian.studio/v1/not_found",
  "title": "Not Found",
  "status": 404,
  "detail": "subscription not found",
  "code": "not_found"
}

{
  "type": "https://errors.lerian.studio/v1/not_found",
  "title": "Not Found",
  "status": 404,
  "detail": "subscription not found",
  "code": "not_found"
}

"<string>"

{
  "type": "https://errors.lerian.studio/v1/not_found",
  "title": "Not Found",
  "status": 404,
  "detail": "subscription not found",
  "code": "not_found"
}

{
  "type": "https://errors.lerian.studio/v1/not_found",
  "title": "Not Found",
  "status": 404,
  "detail": "subscription not found",
  "code": "not_found"
}

{
  "type": "https://errors.lerian.studio/v1/not_found",
  "title": "Not Found",
  "status": 404,
  "detail": "subscription not found",
  "code": "not_found"
}

Set or rotate a queue credential

Sets or rotates the outbound credential for a queue subscription (sqs, rabbitmq, eventbridge) with probe-on-write: the candidate credential is held in memory, probed (connect + auth) immediately, and persisted encrypted only on probe success — a failed probe stores nothing. A successful probe sets verification_state to active: from pending_verification on the first write, and from degraded when a rotation fixes a destination that had started failing. It leaves the enabled flag exactly as it found it. The credential is write-only: it is supplied only here and is never returned, not even masked, on any read path. A classified probe failure is still a 200. This route is naturally idempotent and requires no X-Idempotency header.

PUT

subscriptions

{id}

credential

Set or rotate a queue credential

curl --request PUT \
  --url https://streaming-hub.sandbox.lerian.net/v1/subscriptions/{id}/credential \
  --header 'Authorization: Bearer <token>' \
  --header 'Content-Type: application/json' \
  --data '
{
  "sinkConfig": {
    "uri": "amqps://user:pass@broker.example.com:5671/vhost"
  }
}
'

package main

import (
	"fmt"
	"strings"
	"net/http"
	"io"
)

func main() {

	url := "https://streaming-hub.sandbox.lerian.net/v1/subscriptions/{id}/credential"

	payload := strings.NewReader("{\n  \"sinkConfig\": {\n    \"uri\": \"amqps://user:pass@broker.example.com:5671/vhost\"\n  }\n}")

	req, _ := http.NewRequest("PUT", url, payload)

	req.Header.Add("Authorization", "Bearer <token>")
	req.Header.Add("Content-Type", "application/json")

	res, _ := http.DefaultClient.Do(req)

	defer res.Body.Close()
	body, _ := io.ReadAll(res.Body)

	fmt.Println(string(body))

}

const options = {
  method: 'PUT',
  headers: {Authorization: 'Bearer <token>', 'Content-Type': 'application/json'},
  body: JSON.stringify({sinkConfig: {uri: 'amqps://user:pass@broker.example.com:5671/vhost'}})
};

fetch('https://streaming-hub.sandbox.lerian.net/v1/subscriptions/{id}/credential', options)
  .then(res => res.json())
  .then(res => console.log(res))
  .catch(err => console.error(err));

import requests

url = "https://streaming-hub.sandbox.lerian.net/v1/subscriptions/{id}/credential"

payload = { "sinkConfig": { "uri": "amqps://user:pass@broker.example.com:5671/vhost" } }
headers = {
    "Authorization": "Bearer <token>",
    "Content-Type": "application/json"
}

response = requests.put(url, json=payload, headers=headers)

print(response.text)

{
  "outcome": "ok",
  "statusCode": 200,
  "errorClass": ""
}

{
  "type": "https://errors.lerian.studio/v1/not_found",
  "title": "Not Found",
  "status": 404,
  "detail": "subscription not found",
  "code": "not_found"
}

{
  "type": "https://errors.lerian.studio/v1/not_found",
  "title": "Not Found",
  "status": 404,
  "detail": "subscription not found",
  "code": "not_found"
}

"<string>"

{
  "type": "https://errors.lerian.studio/v1/not_found",
  "title": "Not Found",
  "status": 404,
  "detail": "subscription not found",
  "code": "not_found"
}

{
  "type": "https://errors.lerian.studio/v1/not_found",
  "title": "Not Found",
  "status": 404,
  "detail": "subscription not found",
  "code": "not_found"
}

{
  "type": "https://errors.lerian.studio/v1/not_found",
  "title": "Not Found",
  "status": 404,
  "detail": "subscription not found",
  "code": "not_found"
}

Autorizações

Authorization

string

header

obrigatório

A bearer JWT issued by plugin-auth (lib-auth). The tenant identity is resolved from the validated token claims; the /v1 surface never reads a tenant from the body, path, or query. Machine callers obtain a token via the plugin-auth client-credentials flow. The /admin surface authorizes against an operator scope and carries no tenant context.

Parâmetros de caminho

string<uuid>

obrigatório

The unique identifier of the subscription (UUIDv7).

Corpo

application/json

The queue-credential body. sinkConfig is a kind-specific, write-only object that is probed and, on success, stored encrypted. It is never returned on any read path.

sinkConfig

object

obrigatório

The candidate outbound credential for the queue kind. For rabbitmq, an object such as {"uri":"amqps://user:pass@broker.example.com:5671/vhost"}; for AWS kinds, the region and access material. Write-only — never logged or returned.

Exemplo:

{
  "uri": "amqps://user:pass@broker.example.com:5671/vhost"
}

Resposta

The probe ran; the body carries the classified result. On success the credential was persisted and the subscription is active; on a classified failure nothing was persisted.

The classified result of a synchronous probe (ping, verify, or credential write). A classified failure is still returned with HTTP 200 — the probe ran and produced a verdict. It carries no secret, endpoint, or detail string.

outcome

enum<string>

obrigatório

The classified verdict of a synchronous probe.

Opções disponíveis:

ok,

failed

statusCode

integer

obrigatório

The target's protocol status. For webhook probes, the HTTP status (0 when none applies, e.g. a transport error or a blocked endpoint). For queue-kind credential probes, always 0.

Exemplo:

200

errorClass

string

obrigatório

A frozen taxonomy token classifying a failure. Empty on success.

Exemplo:

""

Catálogo

Subscriptions

Entrega de eventos

Administração

Operacional

Tratamento de erros

Set or rotate a queue credential

Autorizações

Parâmetros de caminho

Corpo

Resposta