---
title: "Regenerate ACME credentials"
source_url: https://dev.digicert.com/partner-subscriptions-api/acme-contract-management/regenerate-acme-credentials.html
api_method: POST
api_endpoint: "/partner-subscription/api/v1/acme/<acme_contract_id>/credentials/regenerate"
api_url: "https://www.digicert.com/partner-subscription/api/v1/acme/{{acme_contract_id}}/credentials/regenerate"
---

**POST** `https://www.digicert.com/partner-subscription/api/v1/acme/{{acme_contract_id}}/credentials/regenerate`

Use this endpoint to generate new ACME External Account Binding (EAB) credentials for an existing ACME contract.

By default, this endpoint revokes all existing credentials before generating new ones. To keep existing credentials active while generating new credentials, set `revoke_existing` to `false`. This is useful for zero-downtime credential rotation.


> **Info**
>
> - This endpoint requires a subaccount Partner Subscriptions API key. Parent account API keys are not accepted for ACME contract operations.
> - Revoking ACME credentials does not cancel the ACME contract. The configuration for SANs, product, and billing does not change and remains active.
> - Existing certificates issued with old credentials remain valid until their natural expiration.


> **Warning**
>
> Update your ACME client configuration with the new `eab_set` values after regenerating credentials. If existing credentials are revoked, ACME clients using the old credentials can no longer issue certificates.


## Example requests and responses

**cURL - Revoke existing credentials**

```bash
curl -X POST \
  https://www.digicert.com/partner-subscription/api/v1/acme/12345/credentials/regenerate \
  -H 'Content-Type: application/json' \
  -H 'X-PARTNER-APIKEY: {{subaccount_partner_api_key}}' \
  -d '{
    "revoke_existing": true
}'
```

**cURL - Keep existing credentials**

```bash
curl -X POST \
  https://www.digicert.com/partner-subscription/api/v1/acme/12345/credentials/regenerate \
  -H 'Content-Type: application/json' \
  -H 'X-PARTNER-APIKEY: {{subaccount_partner_api_key}}' \
  -d '{
    "revoke_existing": false
}'
```

**Python**

```python
import requests

url = "https://www.digicert.com/partner-subscription/api/v1/acme/12345/credentials/regenerate"

payload = "{\n  \"revoke_existing\": true\n}"

headers = {
    'X-PARTNER-APIKEY': "{{subaccount_partner_api_key}}",
    'Content-Type': "application/json"
    }

response = requests.request("POST", url, data=payload, headers=headers)

print(response.text)
```

**Go**

```go
package main

import (
	"fmt"
	"strings"
	"net/http"
	"io/ioutil"
)

func main() {

	url := "https://www.digicert.com/partner-subscription/api/v1/acme/12345/credentials/regenerate"

	payload := strings.NewReader("{\n  \"revoke_existing\": true\n}")

	req, _ := http.NewRequest("POST", url, payload)

	req.Header.Add("X-PARTNER-APIKEY", "{{subaccount_partner_api_key}}")
	req.Header.Add("Content-Type", "application/json")

	res, _ := http.DefaultClient.Do(req)

	defer res.Body.Close()
	body, _ := ioutil.ReadAll(res.Body)

	fmt.Println(res)
	fmt.Println(string(body))

}
```

**NodeJS**

```javascript
var request = require("request");

var options = {
  method: 'POST',
  url: 'https://www.digicert.com/partner-subscription/api/v1/acme/12345/credentials/regenerate',
  headers: {
    'Content-Type': 'application/json',
    'X-PARTNER-APIKEY': '{{subaccount_partner_api_key}}'
  },
  body: {
    revoke_existing: true
  },
  json: true
};

request(options, function (error, response, body) {
  if (error) throw new Error(error);

  console.log(body);
});
```


## 201 Created

```json
{
  "acme_contract_id": 123,
  "account_id": 42,
  "directory_url": "https://acme.digicert.com/v2/acme/directory",
  "eab_set": {
    "kid": "new-eab-kid-value",
    "hmac_key": "new-eab-hmac-key-value"
  },
  "valid_till": "2027-06-03 00:00:00"
}
```


## URL path and query parameters

<table class="params-table">
<thead>
<tr>
<th>Name</th>
<th>Req/Opt</th>
<th>Type</th>
<th>Description</th>
</tr>
</thead>
<tbody>
<tr>
<td>acme_contract_id</td>
<td>required</td>
<td>integer</td>
<td>Unique identifier of the ACME contract.</td>
</tr>
</tbody>
</table>


## Request parameters

<table class="params-table">
<thead>
<tr>
<th>Name</th>
<th>Req/Opt</th>
<th>Type</th>
<th>Default</th>
<th>Description</th>
</tr>
</thead>
<tbody>
<tr>
<td>revoke_existing</td>
<td>optional</td>
<td>boolean</td>
<td><code>true</code></td>
<td>Specify whether to revoke existing ACME credentials before generating new credentials. When set to <code>true</code>, all existing credentials are revoked before new credentials are generated. When set to <code>false</code>, existing credentials remain active, enabling zero-downtime credential rotation.</td>
</tr>
</tbody>
</table>

## Response parameters

<table class="params-table">
<thead>
<tr>
<th>Name</th>
<th>Type</th>
<th>Description</th>
</tr>
</thead>
<tbody>
<tr>
<td>acme_contract_id</td>
<td>integer</td>
<td>Unique identifier of the ACME contract.</td>
</tr>
<tr>
<td>account_id</td>
<td>integer</td>
<td>Identifier of the account associated with the ACME contract.</td>
</tr>
<tr>
<td>directory_url</td>
<td>string</td>
<td>ACME directory URL for the ACME client configuration.</td>
</tr>
<tr>
<td>eab_set</td>
<td>object</td>
<td>External Account Binding credentials generated for the ACME contract.</td>
</tr>
<tr>
<td>.. kid</td>
<td>string</td>
<td>External Account Binding Key ID.</td>
</tr>
<tr>
<td>.. hmac_key</td>
<td>string</td>
<td>External Account Binding HMAC key.</td>
</tr>
<tr>
<td>valid_till</td>
<td>string</td>
<td>Contract expiration date.</td>
</tr>
</tbody>
</table>