Rotating a threat-feed credential
Editing a feed and typing a new key does replace it — leave the field blank and the old one is kept. It is stored as plain text on the feed record, not in the vault.
Your threat-intelligence provider rotated its API key on their end, and now you need to get the new one into the matching feed configuration. Open the feed, edit it, and type the new value into the API key field — that does work, and it does replace the stored value. What trips people up is the field's other half: leaving it blank on an edit is not treated as clearing the key, it is treated as leave it as it is.
Worth knowing: this key is not stored in the vault
Unlike privileged-access credentials, which are envelope-encrypted in the credential vault and never returned to a caller once written, a threat-feed's API key is stored as plain text on the feed's own record and used directly as the request's bearer token or query parameter. Anyone with database access, or any backup of it, can read it in the clear. Treat a threat-feed key the way you would treat a config file, not the way you would treat a privileged-access secret: do not reuse it anywhere sensitive, and rotate it on your provider's side on a schedule you control, independent of anything Qorionix enforces for you.
How to rotate one
Generate the new key with your threat-intelligence provider first
Do this before touching Qorionix, so the feed keeps working on the old key until the moment you switch.
Open the feed under Endpoints and response → Threat feeds and choose Edit
Every other field is pre-filled from the current configuration.
Type the new value into the API key field and save
This is the one field that is not pre-filled with the current value, precisely so you are never shown a live secret back — the same reasoning as One-time secrets, applied to a field rather than a whole credential.
Watch the feed's next poll for an authentication failure
If the new key was mistyped or the old one was revoked on the provider's side before the new one was saved, the feed's status will show it on its next scheduled pull.
What to do next
- Read Threat intelligence feeds for what each feed actually does with the key once it has it.
- If you were expecting vault-grade handling for this credential, read The credential vault to see what that actually looks like for the credentials that do get it.