Improve ability to rotate API and Application

Improve ability to rotate API and Application Client Secrets

We would like to raise a request to have a simpler and smoother experience with the API and Application Client Secret rotations. The use case here we would have in mind would be that if an Application or API Client owning team has a set of credentials, and they would like to rotate the Client Secret (e.g., due to team member leaving team perhaps), they would be able to have a smooth time transitioning over from the old Client Secret to the new one. Please keep in mind in this use case that it would be ideal for the Application team to then be able to migrate over to the new Client Secret on their own schedule (i.e., there needs to be a period of time before the new Secret could be implemented in Production).

Guest
Jul 30 2020
Planned for future release

Comments (2)
Merged ideas (1)

Post comment
Guest commented

4 Feb 03:06pm

We did use the API call to do the API client secret rotation on a trial Tenant, and potentially managed to identify the unique fingerprint on the logs using the /v1.0/events report. We filtered the action by setting filters as :

performedby_type=api
resource=api_client
event_type=management
servicename=apisecurity
api_grant_type=client_credentials
action=modified
For security controls, this should allow us to detect if API client secret rotation has already happened.
Guest commented

5 Aug, 2020 02:59am

Thank you for your idea. We agree with the use case presented here and have accepted the idea for later development prioritization.

1 Vote

Create a new API endpoint or process that allows the ability for application teams to renew or generate Client Secrets for both API and Applications Credentials Merged

This request would be for an API endpoint or simply a new process that could potentially allow an application team to be able to renew/generate a new Client Secret for the credentials they own. This would allow the application team to also self-se...

Created 22 Mar 08:15pm

0 Planned for future release

IBM Security Verify

Improve ability to rotate API and Application Client Secrets

Create a new API endpoint or process that allows the ability for application teams to renew or generate Client Secrets for both API and Applications Credentials Merged

Related ideas

Improve ability to rotate API and Application Client Secrets

Create a new API endpoint or process that allows the ability for application teams to renew or generate Client Secrets for both API and Applications Credentials Merged

Identify yourself with your email address

Related ideas