{"ref":"capability:secrets-rotation","page":"/capabilities/secrets-rotation","json":"/capabilities/secrets-rotation.json","generated":"2026-10-26","drafted_with_ai":true,"entity":{"id":"secrets-rotation","name":"Secrets rotation","domain":"security-and-compliance","ecosystems":["btp","cap"],"universal":true,"description":"Rotating credentials a running service depends on — service keys, destination credentials, API tokens — without downtime and without redeploying. Distinct from storing secrets, which the platform handles.","short":"Rotating credentials without downtime or redeployment","core_coverage":{"state":"core-only","assessed_at":"2026-09-09","what_core_does":"The Credential Store holds passwords, keys and keyrings for an application and serves them over a bound REST API, so rotation happens in the store; the Key Management Service adds customer-managed keys for the platform.","sources":[{"url":"https://github.com/SAP-samples/btp-service-metadata/blob/main/v1/developer/credstore.json","title":"SAP Credential Store — SAP btp-service-metadata v1","checked":"2026-09-09"},{"url":"https://github.com/SAP-samples/btp-service-metadata/blob/main/v1/developer/sap-kms-platform-extension.json","title":"SAP Key Management Service, Platform Extension — SAP btp-service-metadata v1","checked":"2026-09-09"}]},"coverage_by_ecosystem":{"cap":{"state":"core-only","assessed_at":"2026-08-31"}},"gap":{"open_since":"2026-02-01","note":"The platform stores secrets; nothing helps you change them on a schedule while instances are live."},"history":[{"date":"2026-09-14","field":"ecosystems","from":"cap, btp","to":"btp, cap","reason":"Its only provider is the BTP Credential Store, which serves CAP, so BTP is the door whose own answer this is (docs/DOORS.md D9.3). The BTP reading becomes the core reading; the CAP assessment moves to coverage_by_ecosystem.cap unchanged."},{"date":"2026-10-17","field":"description","from":"Rotating credentials a running CAP service depends on — service keys, destination credentials, API tokens — without downtime and without redeploying. Distinct from storing secrets, which the platform handles.","to":"Rotating credentials a running service depends on — service keys, destination credentials, API tokens — without downtime and without redeploying. Distinct from storing secrets, which the platform handles.","reason":"Keep the default capability wording neutral; preserve the previous wording in framing_by_ecosystem.cap. Maintainer-requested scope audit."},{"date":"2026-10-26","field":"coverage_by_ecosystem.cap.state","from":"unmapped","to":"core-only","reason":"Reassessed against the graph (check:capabilities): SAP Credential Store is sap-official and lists cap in serves_ecosystems, so SAP is present for CAP."}],"drafted_with_ai":true,"framing_by_ecosystem":{"cap":{"description":"Rotating credentials a running CAP service depends on — service keys, destination credentials, API tokens — without downtime and without redeploying. Distinct from storing secrets, which the platform handles."}}},"sap_delivery":{"door":"btp","all":{"built_in":[],"documented_pattern":[],"announced":[],"packages":[{"ref":"artifact:btp-credential-store","name":"SAP Credential Store","json":"/artifacts/btp-credential-store.json"}]},"by_flavor":{}},"edges":{"use_cases":[],"shared_tasks":[],"related_tasks":[],"options":[{"ref":"artifact:btp-credential-store","name":"SAP Credential Store","json":"/artifacts/btp-credential-store.json","ecosystem":"btp","origin_ring":"sap-official"}],"samples":[],"explained_by":[],"normative_context":[]}}