# Account: Rotate an agent runner

Contract status: **human-session only**.
Launch state: **Live**.

Rotates a tenant runner credential through the canonical encrypted credential owner; the new secret is never returned.

Operation ID: `rotateHumanAgentRunner`
Method and path: `POST /api/account/agent-security/runners/{runnerRef}/rotate`
Domain owner: `account`
Authentication class: **human session**
Required scope: `human session`
Idempotency required: **yes**
Availability in the generated contract: **available**
Reason code: `human_session_only`

The route is implemented. Availability is account-specific and can change after this document is fetched.

This endpoint uses the signed-in human web session. An agent bearer token cannot call it.

Request schema: `rotateHumanAgentRunner.request.v1`.

Response schema: `rotateHumanAgentRunner.response.v1`.

## Transport projections

- REST: **implemented** at `https://neotask.ai/api/account`.
- MCP: **not_exposed** (reason `human_session_only`).
- CLI: **not_exposed** (reason `human_session_only`).

Read [authenticated capabilities](https://neotask.ai/api/agent/v1/capabilities) before using this operation.