> ## Documentation Index > Fetch the complete documentation index at: https://docs.apostra.com/llms.txt > Use this file to discover all available pages before exploring further. # Rotate ad-server source credentials > In-place credential rotation for an already-provisioned ad-server source. Products, principals, and sync history survive. Required for FreeWheel and SpringServe whose credentials rotate; Google Ad Manager rotation uses the ad-server endpoint above since Scope3 manages those credentials. ## OpenAPI ````yaml /v2/storefront-api-v2.yaml put /inventory-sources/{sourceId}/adapter-config openapi: 3.0.0 info: title: Scope3 Storefront API version: 2.0.0 description: >- REST API for partners to manage Seller Accounts, inventory sources, and billing. ## Authentication All endpoints require a Bearer token in the Authorization header: ``` Authorization: Bearer your-api-key ``` ## Base URL `https://api.interchange.io/api/v2/storefront` ## For AI Agents AI agents can use the MCP endpoint at `/mcp/v2/storefront` with three tools: - `initialize`: Start an MCP session - `api_call`: Make REST API calls - `ask_about_capability`: Learn about API features servers: - url: https://api.interchange.io/api/v2/storefront description: Production server security: [] tags: - name: Account description: Account management, service tokens, and preferences - name: Asks description: >- What you are waiting on Scope3 for — support, product, and supply asks in one list - name: Storefront description: Manage storefront and inventory sources - name: Storefront Agents description: List and manage registered sales, signals, and outcomes agents - name: Storefront Activity description: Audit log of configuration and inventory changes on the storefront - name: Storefront Billing description: Payout bank details and billing configuration for Seller Accounts - name: AI Usage description: Seller Account AI token usage visibility by model - name: MCP description: Model Context Protocol endpoints paths: /inventory-sources/{sourceId}/adapter-config: put: tags: - Storefront summary: Rotate ad-server source credentials description: >- In-place credential rotation for an already-provisioned ad-server source. Products, principals, and sync history survive. Required for FreeWheel and SpringServe whose credentials rotate; Google Ad Manager rotation uses the ad-server endpoint above since Scope3 manages those credentials. operationId: rotateInventorySourceAdapterCredentials parameters: - in: path name: sourceId schema: type: string minLength: 1 description: Inventory source ID required: true description: Inventory source ID requestBody: required: true content: application/json: schema: $ref: '#/components/schemas/AdServerConfig' responses: '200': description: Rotate ad-server source credentials content: application/json: schema: $ref: '#/components/schemas/EsaConnection' '400': description: Bad request content: application/json: schema: $ref: '#/components/schemas/ErrorResponse' '401': description: Unauthorized content: application/json: schema: $ref: '#/components/schemas/ErrorResponse' '500': description: Internal server error content: application/json: schema: $ref: '#/components/schemas/ErrorResponse' security: - bearerAuth: [] components: schemas: AdServerConfig: oneOf: - $ref: '#/components/schemas/GamAdServerConfig' - $ref: '#/components/schemas/FreeWheelAdServerConfig' - $ref: '#/components/schemas/SpringServeAdServerConfig' - $ref: '#/components/schemas/AdsWizzAdServerConfig' description: >- Discriminated union of supported ad-server configurations. Includes credentials for adapter types that authenticate with publisher-supplied credentials (FreeWheel, SpringServe); those credentials are forwarded to the managed ad-server source and never persisted on the local connection row. type: object discriminator: propertyName: type mapping: google_ad_manager: $ref: '#/components/schemas/GamAdServerConfig' freewheel: $ref: '#/components/schemas/FreeWheelAdServerConfig' springserve: $ref: '#/components/schemas/SpringServeAdServerConfig' adswizz: $ref: '#/components/schemas/AdsWizzAdServerConfig' EsaConnection: type: object properties: id: type: string description: >- Stable id for this managed ad-server source. Use this id to address per-source actions (provision, deactivate, save ad-server config, etc.). A customer can have multiple managed sources. name: nullable: true description: >- Seller-facing inventory-source name linked to this managed ad-server source. Null when there is no active linked inventory-source row. type: string customerId: type: integer minimum: -9007199254740991 maximum: 9007199254740991 description: Owning customer/storefront id. tenantId: nullable: true description: >- Upstream managed-source id for the managed ad-server source. Null until provisioning succeeds. type: string mcpUrl: nullable: true description: >- MCP endpoint exposed by the provisioned managed ad-server source. May be a relative path (e.g. `/mcp/`) — the consumer composes the absolute URL using the upstream base URL. type: string a2aUrl: nullable: true description: >- A2A endpoint exposed by the provisioned managed ad-server source. May be a relative path (e.g. `/a2a`) — see `mcpUrl` for resolution. type: string adServer: nullable: true description: Publisher-supplied ad-server config. Null if not yet collected. allOf: - $ref: '#/components/schemas/AdServerConfigView' serviceAccountEmail: nullable: true description: >- Per-customer service-account email the publisher must grant access to in their ad server. Created when ad-server config is saved. Surfaced so the UI can show it during onboarding. type: string format: email pattern: >- ^(?!\.)(?!.*\.\.)([A-Za-z0-9_'+\-\.]*)[A-Za-z0-9_+-]@([A-Za-z0-9][A-Za-z0-9\-]*\.)+[A-Za-z]{2,}$ lastError: nullable: true description: >- Failure reason from the most recent provisioning or test-connection attempt, or the current adapter-configuration reconciliation state. type: string lastErrorCode: nullable: true description: >- Machine-readable classification of the most recent provisioning failure or a configuration change awaiting reconciliation. `ADAPTER_NETWORK_NOT_FOUND`, `ADAPTER_PERMISSION_DENIED`, `ADAPTER_INVALID_CREDENTIALS`, `ADAPTER_INVALID_CONFIG`, and `ADAPTER_CONNECTION_FAILED` are adapter probe failures. `ADAPTER_CONFIG_*` and `EXECUTION_CURRENCY_*` describe configuration work that has not settled. `INTERNAL_ERROR` indicates an upstream or platform problem. Null when there has been no failure and no pending configuration work. type: string lastTestedAt: nullable: true type: string format: date-time pattern: >- ^(?:(?:\d\d[2468][048]|\d\d[13579][26]|\d\d0[48]|[02468][048]00|[13579][26]00)-02-29|\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\d|30)|(?:02)-(?:0[1-9]|1\d|2[0-8])))T(?:(?:[01]\d|2[0-3]):[0-5]\d(?::[0-5]\d(?:\.\d+)?)?(?:Z))$ provisionedAt: nullable: true type: string format: date-time pattern: >- ^(?:(?:\d\d[2468][048]|\d\d[13579][26]|\d\d0[48]|[02468][048]00|[13579][26]00)-02-29|\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\d|30)|(?:02)-(?:0[1-9]|1\d|2[0-8])))T(?:(?:[01]\d|2[0-3]):[0-5]\d(?::[0-5]\d(?:\.\d+)?)?(?:Z))$ deactivatedAt: nullable: true type: string format: date-time pattern: >- ^(?:(?:\d\d[2468][048]|\d\d[13579][26]|\d\d0[48]|[02468][048]00|[13579][26]00)-02-29|\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\d|30)|(?:02)-(?:0[1-9]|1\d|2[0-8])))T(?:(?:[01]\d|2[0-3]):[0-5]\d(?::[0-5]\d(?:\.\d+)?)?(?:Z))$ createdAt: type: string format: date-time pattern: >- ^(?:(?:\d\d[2468][048]|\d\d[13579][26]|\d\d0[48]|[02468][048]00|[13579][26]00)-02-29|\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\d|30)|(?:02)-(?:0[1-9]|1\d|2[0-8])))T(?:(?:[01]\d|2[0-3]):[0-5]\d(?::[0-5]\d(?:\.\d+)?)?(?:Z))$ updatedAt: type: string format: date-time pattern: >- ^(?:(?:\d\d[2468][048]|\d\d[13579][26]|\d\d0[48]|[02468][048]00|[13579][26]00)-02-29|\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\d|30)|(?:02)-(?:0[1-9]|1\d|2[0-8])))T(?:(?:[01]\d|2[0-3]):[0-5]\d(?::[0-5]\d(?:\.\d+)?)?(?:Z))$ inventorySync: nullable: true description: >- Cached inventory-sync state. Null when no signal has landed yet (no webhook delivered and no /status poll has run). allOf: - $ref: '#/components/schemas/EsaInventorySync' required: - id - name - customerId - tenantId - mcpUrl - a2aUrl - adServer - serviceAccountEmail - lastError - lastErrorCode - lastTestedAt - provisionedAt - deactivatedAt - createdAt - updatedAt - inventorySync additionalProperties: false description: >- Storefront → managed ad-server source connection. A storefront can have multiple connections, each addressed by `id`. ErrorResponse: type: object properties: data: type: string nullable: true enum: - null error: $ref: '#/components/schemas/ApiError' required: - data - error additionalProperties: false description: Standard error response GamAdServerConfig: type: object properties: type: type: string enum: - google_ad_manager connectionContract: description: >- Pinned built-in GAM connection contract. Omit only for legacy clients that have not migrated yet. type: object properties: id: type: string minLength: 1 maxLength: 128 pattern: ^[a-z][a-z0-9_-]*$ version: type: integer minimum: 0 exclusiveMinimum: true maximum: 9007199254740991 authenticationMethod: type: string enum: - none - bearer_token - api_key - credential_exchange - basic_auth - oauth2 - jwt - platform_service_account required: - id - version - authenticationMethod additionalProperties: false networkCode: type: string minLength: 1 maxLength: 32 pattern: ^[0-9]+$ description: Google Ad Manager network code. example: '12345678' required: - type - networkCode description: >- Google Ad Manager configuration. Per-customer service-account credentials are managed by Scope3 (publisher grants access in their GAM admin console). FreeWheelAdServerConfig: type: object properties: type: type: string enum: - freewheel connectionContract: description: >- Pinned built-in FreeWheel connection contract. Omit only for legacy clients that have not migrated yet. type: object properties: id: type: string minLength: 1 maxLength: 128 pattern: ^[a-z][a-z0-9_-]*$ version: type: integer minimum: 0 exclusiveMinimum: true maximum: 9007199254740991 authenticationMethod: type: string enum: - none - bearer_token - api_key - credential_exchange - basic_auth - oauth2 - jwt - platform_service_account required: - id - version - authenticationMethod additionalProperties: false clientId: description: >- FreeWheel Publisher API client ID for the OAuth2 client_credentials grant. Required with `clientSecret`; omit when using legacy `username`/`password` or `apiToken`. type: string minLength: 1 maxLength: 255 clientSecret: description: >- FreeWheel Publisher API client secret for the OAuth2 client_credentials grant. Required with `clientId`. Write-only — never returned or written to the Interchange connection row; encrypted by the managed source. type: string minLength: 1 username: description: >- Legacy FreeWheel Publisher API username for password-grant authentication. Prefer `clientId` + `clientSecret` for partner-program credentials. type: string minLength: 1 maxLength: 255 password: description: >- Legacy FreeWheel Publisher API password for password-grant authentication. Write-only — never returned or written to the Interchange connection row; encrypted by the managed source. type: string minLength: 1 apiToken: description: >- Pre-minted FreeWheel API token (e.g. a 7-day temporary access key). Write-only — never returned or written to the Interchange connection row; encrypted by the managed source. Recommended for testing only; production deployments should use the client ID/client secret path which auto-refreshes. type: string minLength: 1 environment: default: production description: >- FreeWheel environment to target. Sandbox is intended for testing only. type: string enum: - production - staging - sandbox defaultAdvertiserId: description: Optional default FreeWheel advertiser id. type: string maxLength: 64 executionCurrency: description: >- FreeWheel commercial booking currency. New clients should send it explicitly. When omitted by a legacy create client, the API materializes the confirmed storefront default; when omitted during credential rotation, it preserves the current ESA execution currency. FreeWheel remains blocked until its write semantics are certified. type: string pattern: ^[A-Z]{3}$ required: - type description: >- FreeWheel Publisher API adapter configuration. Credentials are forwarded to the managed ad-server source and never persisted on the local connection row. SpringServeAdServerConfig: type: object properties: type: type: string enum: - springserve connectionContract: description: >- Pinned built-in SpringServe connection contract. Omit only for legacy clients that have not migrated yet. type: object properties: id: type: string minLength: 1 maxLength: 128 pattern: ^[a-z][a-z0-9_-]*$ version: type: integer minimum: 0 exclusiveMinimum: true maximum: 9007199254740991 authenticationMethod: type: string enum: - none - bearer_token - api_key - credential_exchange - basic_auth - oauth2 - jwt - platform_service_account required: - id - version - authenticationMethod additionalProperties: false email: description: >- SpringServe login email. Required when authenticating with password grant; omit when using `apiToken`. type: string maxLength: 255 format: email pattern: >- ^(?!\.)(?!.*\.\.)([A-Za-z0-9_'+\-\.]*)[A-Za-z0-9_+-]@([A-Za-z0-9][A-Za-z0-9\-]*\.)+[A-Za-z]{2,}$ password: description: >- SpringServe password. Required when authenticating with password grant. Write-only — never returned by the API or persisted by Scope3. type: string minLength: 1 apiToken: description: >- Pre-minted SpringServe API token. Write-only — only used when no email/password is supplied. Recommended for testing only; production deployments should use the email/password grant which auto-refreshes. type: string minLength: 1 environment: default: production description: SpringServe environment. Only `production` is supported. type: string enum: - production defaultDemandPartnerId: description: Optional default SpringServe demand partner id. type: integer minimum: 0 exclusiveMinimum: true maximum: 9007199254740991 rateCurrency: description: >- Currency for SpringServe Campaign and Demand Tag rates. New clients should send it explicitly. When omitted by a legacy create client, the API materializes the confirmed storefront default; when omitted during credential rotation, it preserves the current ESA execution currency. type: string pattern: ^[A-Z]{3}$ required: - type description: >- SpringServe (Magnite) adapter configuration. Credentials are forwarded to the managed ad-server source and never persisted on the local connection row. AdsWizzAdServerConfig: type: object properties: type: type: string enum: - adswizz connectionContract: description: >- Pinned built-in AdsWizz connection contract. Omit only for legacy clients that have not migrated yet. type: object properties: id: type: string minLength: 1 maxLength: 128 pattern: ^[a-z][a-z0-9_-]*$ version: type: integer minimum: 0 exclusiveMinimum: true maximum: 9007199254740991 authenticationMethod: type: string enum: - none - bearer_token - api_key - credential_exchange - basic_auth - oauth2 - jwt - platform_service_account required: - id - version - authenticationMethod additionalProperties: false apiKey: description: >- AdsWizz static API key, sent as the `x-api-key` header on every request. Required on write; write-only — never returned by the API or persisted by Scope3. writeOnly: true type: string minLength: 1 agencyId: type: integer minimum: 0 exclusiveMinimum: true maximum: 9007199254740991 description: >- AdsWizz agency id (sent as the `agency` header; scopes the billing currency and CPM ceiling). environment: default: AUDIOSERVE description: >- AdsWizz surface. Pinned to AUDIOSERVE (direct trafficking); AUDIOMAX/AUDIOMATIC are SSP-only and not supported. type: string enum: - AUDIOSERVE baseUrl: default: https://api.adswizz.com/domain/v8 description: AdsWizz Domain API v8 base URL. type: string format: uri forecastingBaseUrl: default: https://api.adswizz.com/forecasting/v3 description: AdsWizz Forecasting API v3 base URL (backs availability). type: string format: uri defaultCurrency: type: string pattern: ^[A-Z]{3}$ description: >- Three-letter currency code the agency bills in (e.g. ZAR). Required — AdsWizz fixes the billing currency per agency, so it must be stated explicitly rather than defaulted; selected product pricing must match it. cpmLimit: default: null description: >- Agency CPM ceiling. Every rate is guarded against this before any write. nullable: true type: number minimum: 0 exclusiveMinimum: true defaultAdvertiserId: default: null description: >- Fallback AdsWizz advertiser id for principals without an explicit AdsWizz mapping. nullable: true type: string maxLength: 64 required: - type - agencyId - defaultCurrency description: >- AdsWizz Domain API v8 (streaming audio + podcast) adapter configuration. The static API key is forwarded to the managed ad-server source and never persisted on the local connection row. AdServerConfigView: oneOf: - type: object properties: type: type: string enum: - google_ad_manager networkCode: type: string minLength: 1 maxLength: 32 pattern: ^[0-9]+$ description: Google Ad Manager network code. example: '12345678' required: - type - networkCode additionalProperties: false - type: object properties: type: type: string enum: - freewheel clientId: nullable: true type: string username: nullable: true type: string environment: type: string enum: - production - staging - sandbox defaultAdvertiserId: nullable: true type: string executionCurrency: default: null nullable: true type: string required: - type - clientId - username - environment - defaultAdvertiserId - executionCurrency additionalProperties: false - type: object properties: type: type: string enum: - springserve email: nullable: true type: string environment: type: string enum: - production defaultDemandPartnerId: nullable: true type: integer minimum: -9007199254740991 maximum: 9007199254740991 rateCurrency: default: null nullable: true type: string required: - type - email - environment - defaultDemandPartnerId - rateCurrency additionalProperties: false - type: object properties: type: type: string enum: - adswizz agencyId: type: integer minimum: -9007199254740991 maximum: 9007199254740991 environment: type: string enum: - AUDIOSERVE baseUrl: type: string forecastingBaseUrl: type: string defaultCurrency: type: string cpmLimit: nullable: true type: number defaultAdvertiserId: nullable: true type: string required: - type - agencyId - environment - baseUrl - forecastingBaseUrl - defaultCurrency - cpmLimit - defaultAdvertiserId additionalProperties: false description: >- Non-secret view of the connection ad-server config. Returned by GET endpoints; never contains credentials. type: object EsaInventorySync: type: object properties: status: nullable: true type: string enum: - unknown - never_run - running - success - failed description: >- Last known inventory-sync state on the upstream managed source. `unknown` means we have no signal yet (row predates the sync tracking, no webhook or status poll has landed). Other values mirror the upstream managed-source vocabulary. lastRunAt: nullable: true type: string format: date-time pattern: >- ^(?:(?:\d\d[2468][048]|\d\d[13579][26]|\d\d0[48]|[02468][048]00|[13579][26]00)-02-29|\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\d|30)|(?:02)-(?:0[1-9]|1\d|2[0-8])))T(?:(?:[01]\d|2[0-3]):[0-5]\d(?::[0-5]\d(?:\.\d+)?)?(?:Z))$ completedAt: nullable: true type: string format: date-time pattern: >- ^(?:(?:\d\d[2468][048]|\d\d[13579][26]|\d\d0[48]|[02468][048]00|[13579][26]00)-02-29|\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\d|30)|(?:02)-(?:0[1-9]|1\d|2[0-8])))T(?:(?:[01]\d|2[0-3]):[0-5]\d(?::[0-5]\d(?:\.\d+)?)?(?:Z))$ itemCount: nullable: true type: integer minimum: -9007199254740991 maximum: 9007199254740991 error: nullable: true type: string updatedAt: nullable: true type: string format: date-time pattern: >- ^(?:(?:\d\d[2468][048]|\d\d[13579][26]|\d\d0[48]|[02468][048]00|[13579][26]00)-02-29|\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\d|30)|(?:02)-(?:0[1-9]|1\d|2[0-8])))T(?:(?:[01]\d|2[0-3]):[0-5]\d(?::[0-5]\d(?:\.\d+)?)?(?:Z))$ required: - status - lastRunAt - completedAt - itemCount - error - updatedAt additionalProperties: false description: >- Cached inventory-sync state for this managed ad-server source. Updated by the /webhooks/esa-sync receiver when the upstream service emits `sync_run.completed` / `sync_run.failed`, and by the /status polling fallback for missed deliveries. ApiError: type: object properties: code: type: string description: Machine-readable error code message: type: string description: Human-readable error message field: description: Field path associated with the error type: string details: description: Additional error context type: object additionalProperties: {} required: - code - message additionalProperties: false description: Structured error object securitySchemes: bearerAuth: type: http scheme: bearer description: API key or access token ````