Generate a new 256-bit HMAC secret and atomically replaces the stored ciphertext + fingerprint. The OLD secret immediately stops verifying — You must update the partner's verifier in lock-step. The endpoint returns the new raw secret ONCE in hmac_secret. No request body required.

Auth: Partner — authentication; findCallerSubscription enforces bundle_id === 1 and scopes by partner_company_id (404 if not owned).

Rate limit: No rate limit.

Request

• No body.

Response — { data: { data: {.} } } envelope (HTTP 200). All presenter fields (with the rotated hmac_secret_fingerprint), PLUS:

• hmac_secret (string) — new raw secret, shown ONCE
• hmac_secret_warning (string) — notes the previous secret is no longer accepted

Path params