Batch rotate destination secrets

Updated on Sep 10, 2026
Published on Aug 24, 2026

Patch

/teams/{team_id}/destinations/batch

Rotate secrets for multiple destinations of the same type in a single request. Each update is applied independently — if one fails, the others still succeed.

Batch-level validations (checked before any processing):

The updates array must contain between 1 and 100 items.
Each item must include a valid destination_id and a non-empty new_secret.
Duplicate destination_id values are not allowed.

Security

HTTP

Type bearer

API key authentication. Create API keys in the Supermetrics Hub and send them in the Authorization header: Authorization: Bearer <your-api-key>

Path parameters

team_id

integer (int64) Required

ID of the team

Minimum1

Maximum9223372036854776000

Example936506

Body parameters

Batch of secret rotations sharing a single destination type

Expand All

object

type

string Required

Destination type shared by all items in the batch

ExampleDWH_SNOWFLAKE

updates

Array of object Required

Min items1

Max items100

object

destination_id

integer Required

ID of the destination to rotate the secret for

new_secret

string Required

New secret value for credential rotation

Responses

200

Batch processed

Headers

Access-Control-Allow-Origin

string

CORS header

Valid values[ "*" ]

Max length255

Example*

Expand All

object

meta

object (Meta)

Metadata included in every API response.

request_id

string

Unique identifier for the request, for tracking and debugging.

Min length8

Max length64

Pattern^[A-Za-z0-9_-]+$

ExampleBXaEFVtjc7TXaJxgZhmFgSUD9edqq_CN

data

object

has_errors

boolean

True if any item in the batch failed. Allows quick failure detection without iterating all results.

results

Array of object

object

destination_id

integer

status

string

Valid values[ "success", "error" ]

error_code

string

Error code identifying the failure reason. Only present when status is error.

message

string

Human-readable error description. Only present when status is error.

400

Bad request - invalid parameters

Headers

X-RateLimit-Limit

integer

Request limit per hour

Minimum1

Maximum10000

Example5000

X-RateLimit-Remaining

integer

Remaining requests in current window

Minimum0

Maximum10000

Example4999

Access-Control-Allow-Origin

string

CORS header

Valid values[ "*" ]

Max length255

Example*

{
  "meta": {
    "request_id": "BXaEFVtjc7TXaJxgZhmFgSUD9edqq_CN"
  },
  "error": {
    "code": "BAD_REQUEST",
    "message": "The request was invalid."
  }
}

Expand All

object

Standard envelope returned by all error (4xx/5xx) responses.

meta

object (Meta)

Metadata included in every API response.

request_id

string

Unique identifier for the request, for tracking and debugging.

Min length8

Max length64

Pattern^[A-Za-z0-9_-]+$

ExampleBXaEFVtjc7TXaJxgZhmFgSUD9edqq_CN

error

object (Error)

Machine- and human-readable detail for a failed request.

code

string

Stable, screaming-snake-case identifier for the error condition. Clients should branch on this, not on message. Common values include BAD_REQUEST, UNAUTHORIZED, FORBIDDEN, NOT_FOUND, CONFLICT_ERROR, PERMISSION_ERROR, UNPROCESSABLE_ENTITY, UNPROCESSABLE_CONTENT, TOO_MANY_REQUESTS, INTERNAL_SERVER_ERROR, DUPLICATION_FAILED, SERVICE_UNAVAILABLE; domains may define additional codes.

Max length100

Pattern^[A-Z][A-Z0-9_]*$

ExampleBAD_REQUEST

message

string

Short, human-readable summary of the error.

Max length255

Pattern^.+$

ExampleThe request was invalid.

description

string

Optional longer explanation specific to this occurrence.

Max length2048

ExampleThe field 'display_name' must not be empty.

401

Unauthorized

Headers

WWW-Authenticate

string

Bearer token required

Max length255

Pattern^Bearer.*

X-RateLimit-Limit

integer

Request limit per hour

Minimum1

Maximum10000

Example5000

X-RateLimit-Remaining

integer

Remaining requests in current window

Minimum0

Maximum10000

Example4999

Access-Control-Allow-Origin

string

CORS header

Valid values[ "*" ]

Max length255

Example*

{
  "meta": {
    "request_id": "BXaEFVtjc7TXaJxgZhmFgSUD9edqq_CN"
  },
  "error": {
    "code": "UNAUTHORIZED",
    "message": "Authentication is required."
  }
}

Expand All

object

Standard envelope returned by all error (4xx/5xx) responses.

meta

object (Meta)

Metadata included in every API response.

request_id

string

Unique identifier for the request, for tracking and debugging.

Min length8

Max length64

Pattern^[A-Za-z0-9_-]+$

ExampleBXaEFVtjc7TXaJxgZhmFgSUD9edqq_CN

error

object (Error)

Machine- and human-readable detail for a failed request.

code

string

Max length100

Pattern^[A-Z][A-Z0-9_]*$

ExampleBAD_REQUEST

message

string

Short, human-readable summary of the error.

Max length255

Pattern^.+$

ExampleThe request was invalid.

description

string

Optional longer explanation specific to this occurrence.

Max length2048

ExampleThe field 'display_name' must not be empty.

403

Access forbidden

Headers

X-RateLimit-Limit

integer

Request limit per hour

Minimum1

Maximum10000

Example5000

X-RateLimit-Remaining

integer

Remaining requests in current window

Minimum0

Maximum10000

Example4999

Access-Control-Allow-Origin

string

CORS header

Valid values[ "*" ]

Max length255

Example*

{
  "meta": {
    "request_id": "BXaEFVtjc7TXaJxgZhmFgSUD9edqq_CN"
  },
  "error": {
    "code": "FORBIDDEN",
    "message": "You do not have access to this resource."
  }
}

Expand All

object

Standard envelope returned by all error (4xx/5xx) responses.

meta

object (Meta)

Metadata included in every API response.

request_id

string

Unique identifier for the request, for tracking and debugging.

Min length8

Max length64

Pattern^[A-Za-z0-9_-]+$

ExampleBXaEFVtjc7TXaJxgZhmFgSUD9edqq_CN

error

object (Error)

Machine- and human-readable detail for a failed request.

code

string

Max length100

Pattern^[A-Z][A-Z0-9_]*$

ExampleBAD_REQUEST

message

string

Short, human-readable summary of the error.

Max length255

Pattern^.+$

ExampleThe request was invalid.

description

string

Optional longer explanation specific to this occurrence.

Max length2048

ExampleThe field 'display_name' must not be empty.

500

Internal server error

Headers

Access-Control-Allow-Origin

string

CORS header

Valid values[ "*" ]

Max length255

Example*

{
  "meta": {
    "request_id": "BXaEFVtjc7TXaJxgZhmFgSUD9edqq_CN"
  },
  "error": {
    "code": "INTERNAL_SERVER_ERROR",
    "message": "An unexpected error occurred."
  }
}

Expand All

object

Standard envelope returned by all error (4xx/5xx) responses.

meta

object (Meta)

Metadata included in every API response.

request_id

string

Unique identifier for the request, for tracking and debugging.

Min length8

Max length64

Pattern^[A-Za-z0-9_-]+$

ExampleBXaEFVtjc7TXaJxgZhmFgSUD9edqq_CN

error

object (Error)

Machine- and human-readable detail for a failed request.

code

string

Max length100

Pattern^[A-Z][A-Z0-9_]*$

ExampleBAD_REQUEST

message

string

Short, human-readable summary of the error.

Max length255

Pattern^.+$

ExampleThe request was invalid.

description

string

Optional longer explanation specific to this occurrence.

Max length2048

ExampleThe field 'display_name' must not be empty.

Was this article helpful?