action conjur_rotate_api_key {
  label: "Rotates a role's API key."
  description: "Any role can rotate its own API key. The name and password\n(for users) or current API key (for hosts and users) of the role must\nbe provided via HTTP Basic Authorization.\n\nTo rotate another role's API key, you may provide your name and password\n(for users) or current API key (for hosts and users) via HTTP Basic\nAuthorization with the request. Alternatively, you may provide your\nConjur access token via the standard Conjur `Authorization` header.\n\nThe Basic authentication-compliant header is formed by:\n1. Concatenating the role's name, a literal colon character ':',\n   and the password or API key to create the authentication string.\n2. Base64-encoding the authentication string.\n3. Prefixing the authentication string with the scheme: `Basic `\n   (note the required space).\n4. Providing the result as the value of the `Authorization` HTTP header:\n   `Authorization: Basic <authentication string>`.\n\nYour HTTP/REST client probably provides HTTP basic authentication support.\nFor example, `curl` and all of the Conjur client libraries provide this.\n\nIf using the Conjur `Authorization` header, its value should be set to\n`Token token=<base64-encoded access token>`.\n\nNote that the body of the request must be the empty string.\n"
  provider: conjur
  method: PUT
  path: "/authn/{account}/api_key"
  encoding: json
  input: {
    type: "object"
    properties: {
      account: {
        type: "string"
        description: "Conjur account name"
      }
      role: {
        type: "string"
        description: "##### Kinds of roles:\n\n- User: one unique wonderful human\n- Host: a single logical machine (in the broad sense, not just physical)\n- Layer: a collection of hosts that have the same privileges\n- Group: a collection of users and groups that have the same privileges\n- Policy: a role which owns of a set of related object\n\nAny identifier included in the URL must be URL-encoded to be recognized by the Conjur API.\n\n##### Resource Identifiers:\n\n- `myapp-01` -> `myapp-01` (unchanged)\n- `alice@devops` -> `alice%40devops`\n- `prod/aws/db-password` -> `prod%2Faws%2Fdb-password`\n- `research+development` -> `research%2Bdevelopment`\n- `sales&marketing` -> `sales%26marketing`\n"
      }
    }
    required: ["account"]
    additionalProperties: false
  }
  output: {
    type: "object"
    additionalProperties: true
  }
}