2026/09/25 - Amazon Bedrock AgentCore Control - 1 new2 updated api methods
Changes Amazon Bedrock AgentCore Payments now supports credential rotation for payment connectors, letting you rotate API and wallet secrets for Quick Create payment auths from the console. This release also adds Type and Creation type columns to the payment managers views.
Replaces the service-managed credentials of a payment connector with newly issued credentials.
Use this operation only for payment connectors with a provisionMode of QUICK_CREATE. For payment connectors with a provisionMode of MANUAL, call UpdatePaymentCredentialProvider instead after rotating credentials with the payment provider directly.
The rotation finishes before the response is returned, and only one rotation runs at a time for a given payment connector. When it succeeds, the new credential is in effect and the payment connector stays in the READY state. When it fails, an error is returned, the payment connector and its existing credential are left unchanged, and you can retry the request.
Rotation replaces the credential on the connector's credential provider, so every payment connector that uses that provider is affected. Replace any copy of the previous credential that you use outside AgentCore.
See also: AWS API Documentation
Request Syntax
client.rotate_payment_connector_credentials(
paymentManagerId='string',
paymentConnectorId='string',
credentialsToRotate={
'coinbaseCDP': {
'secrets': [
'API_KEY'|'WALLET_SECRET',
]
}
},
clientToken='string'
)
string
[REQUIRED]
The unique identifier of the parent payment manager.
string
[REQUIRED]
The unique identifier of the payment connector whose credentials you want to rotate.
dict
[REQUIRED]
The credentials to rotate. Specify the member that matches the payment connector's type. Each credential that you select is rotated independently.
coinbaseCDP (dict) --
The credentials to rotate for a Coinbase CDP payment connector.
secrets (list) -- [REQUIRED]
The secrets to rotate. Specify at least one value. Each secret that you specify is rotated independently.
API_KEY - The API key that the payment connector uses to call Coinbase CDP. Rotate it as routine maintenance, or if you suspect that it is compromised.
WALLET_SECRET - The wallet secret that signs transactions. Rotate it only if it is lost or compromised. Coinbase CDP allows one wallet secret per project, so it is replaced in place and signing can be briefly interrupted.
(string) --
string
A unique, case-sensitive identifier to ensure that the API request completes no more than one time. If you don't specify this field, a value is randomly generated for you. If this token matches a previous request, the service ignores the request, but doesn't return an error. For more information, see Ensuring idempotency.
This field is autopopulated if not provided.
dict
Response Syntax
{
'paymentConnectorId': 'string',
'paymentManagerId': 'string',
'lastUpdatedAt': datetime(2015, 1, 1),
'status': 'CREATING'|'UPDATING'|'DELETING'|'READY'|'CREATE_FAILED'|'UPDATE_FAILED'|'DELETE_FAILED'|'AWS_MARKETPLACE_SUBSCRIPTION_REQUIRED'|'PENDING_AUTHENTICATION'|'PROVISIONING'|'AUTHENTICATION_EXPIRED'|'AUTHENTICATION_FAILED'
}
Response Structure
(dict) --
paymentConnectorId (string) --
The unique identifier of the payment connector.
paymentManagerId (string) --
The unique identifier of the parent payment manager.
lastUpdatedAt (datetime) --
The timestamp when the payment connector was last updated, which is when the rotation completed.
status (string) --
The current status of the payment connector, which is READY after a successful rotation.
{'credentialsUpdatedAt': 'timestamp', 'provisionMode': 'MANUAL | QUICK_CREATE'}
Retrieves information about a specific payment connector.
See also: AWS API Documentation
Request Syntax
client.get_payment_connector(
paymentManagerId='string',
paymentConnectorId='string'
)
string
[REQUIRED]
The unique identifier of the parent payment manager.
string
[REQUIRED]
The unique identifier of the payment connector to retrieve.
dict
Response Syntax
{
'paymentConnectorId': 'string',
'name': 'string',
'description': 'string',
'type': 'CoinbaseCDP'|'StripePrivy',
'provisionMode': 'MANUAL'|'QUICK_CREATE',
'credentialProviderConfigurations': [
{
'coinbaseCDP': {
'credentialProviderArn': 'string'
},
'stripePrivy': {
'credentialProviderArn': 'string'
}
},
],
'createdAt': datetime(2015, 1, 1),
'lastUpdatedAt': datetime(2015, 1, 1),
'status': 'CREATING'|'UPDATING'|'DELETING'|'READY'|'CREATE_FAILED'|'UPDATE_FAILED'|'DELETE_FAILED'|'AWS_MARKETPLACE_SUBSCRIPTION_REQUIRED'|'PENDING_AUTHENTICATION'|'PROVISIONING'|'AUTHENTICATION_EXPIRED'|'AUTHENTICATION_FAILED',
'authorizationUrl': 'string',
'credentialsUpdatedAt': datetime(2015, 1, 1)
}
Response Structure
(dict) --
paymentConnectorId (string) --
The unique identifier of the payment connector.
name (string) --
The name of the payment connector.
description (string) --
The description of the payment connector.
type (string) --
The type of the payment connector, which determines the payment provider integration.
provisionMode (string) --
Specifies how the payment connector was provisioned. Payment connectors that were created before this field was available return MANUAL.
MANUAL - You provided the credential provider configurations, so you own the credentials. Rotate them with the payment provider, then call UpdatePaymentCredentialProvider.
QUICK_CREATE - AgentCore provisioned the credential provider for you, so the credentials are service-managed. You can rotate them with RotatePaymentConnectorCredentials.
credentialProviderConfigurations (list) --
The credential provider configurations for the payment connector.
(dict) --
The credential provider configuration for a payment connector. Specifies the payment provider type and its associated credential provider.
coinbaseCDP (dict) --
The credential provider configuration for a Coinbase CDP payment connector.
credentialProviderArn (string) --
The Amazon Resource Name (ARN) of the credential provider that stores the authentication credentials for the payment provider.
stripePrivy (dict) --
The credential provider configuration for a Stripe Privy payment connector.
credentialProviderArn (string) --
The Amazon Resource Name (ARN) of the credential provider that stores the authentication credentials for the payment provider.
createdAt (datetime) --
The timestamp when the payment connector was created.
lastUpdatedAt (datetime) --
The timestamp when the payment connector was last updated.
status (string) --
The current status of the payment connector. Possible values include CREATING, READY, UPDATING, DELETING, CREATE_FAILED, UPDATE_FAILED, and DELETE_FAILED.
authorizationUrl (string) --
The URL that the user must open to complete OAuth consent. This field is only present when the payment connector status is PENDING_AUTHENTICATION.
credentialsUpdatedAt (datetime) --
The timestamp when the payment connector's current service-managed credentials took effect. It is first set when the credentials are provisioned and is updated by each rotation. This field is present only for payment connectors with a provisionMode of QUICK_CREATE.
{'paymentConnectors': {'provisionMode': 'MANUAL | QUICK_CREATE'}}
Lists all payment connectors for a specified payment manager.
See also: AWS API Documentation
Request Syntax
client.list_payment_connectors(
paymentManagerId='string',
maxResults=123,
nextToken='string'
)
string
[REQUIRED]
The unique identifier of the payment manager whose connectors to list.
integer
The maximum number of results to return in the response. If the total number of results is greater than this value, use the token returned in the response in the nextToken field when making another request to return the next batch of results.
string
If the total number of results is greater than the maxResults value provided in the request, enter the token returned in the nextToken field in the response in this field to return the next batch of results.
dict
Response Syntax
{
'paymentConnectors': [
{
'paymentConnectorId': 'string',
'name': 'string',
'type': 'CoinbaseCDP'|'StripePrivy',
'provisionMode': 'MANUAL'|'QUICK_CREATE',
'status': 'CREATING'|'UPDATING'|'DELETING'|'READY'|'CREATE_FAILED'|'UPDATE_FAILED'|'DELETE_FAILED'|'AWS_MARKETPLACE_SUBSCRIPTION_REQUIRED'|'PENDING_AUTHENTICATION'|'PROVISIONING'|'AUTHENTICATION_EXPIRED'|'AUTHENTICATION_FAILED',
'lastUpdatedAt': datetime(2015, 1, 1)
},
],
'nextToken': 'string'
}
Response Structure
(dict) --
paymentConnectors (list) --
The list of payment connector summaries. For details about the fields in each summary, see the PaymentConnectorSummary data type.
(dict) --
Contains summary information about a payment connector.
paymentConnectorId (string) --
The unique identifier of the payment connector.
name (string) --
The name of the payment connector.
type (string) --
The type of the payment connector, which determines the payment provider integration.
provisionMode (string) --
Specifies how the payment connector was provisioned. Payment connectors that were created before this field was available return MANUAL.
MANUAL - You provided the credential provider configurations, so you own the credentials.
QUICK_CREATE - AgentCore provisioned the credential provider for you, so the credentials are service-managed and you can rotate them with RotatePaymentConnectorCredentials.
status (string) --
The current status of the payment connector. Possible values include CREATING, READY, UPDATING, DELETING, CREATE_FAILED, UPDATE_FAILED, and DELETE_FAILED.
lastUpdatedAt (datetime) --
The timestamp when the payment connector was last updated.
nextToken (string) --
If the total number of results is greater than the maxResults value provided in the request, use this token when making another request in the nextToken field to return the next batch of results.