### Rotate a NAS shared secret

`POST /api/v1/admin/nas/{id}/rotate-secret`

Issues a new shared secret for the device. The router must be updated to match, or it stops authenticating — this endpoint changes the platform side only.

- Authentication: manager session (JWT) or API token
- Permission: `prm_nas_update` (Edit NAS)
- Risk: write
- Rate limit bucket: `t_mutate`

#### Parameters

| Name | In | Type | Required | Description |
| --- | --- | --- | --- | --- |
| `id` | path | integer | yes | NAS id. |

#### Note

There is no overlap window. From the moment this returns, RADIUS packets signed with the old secret are rejected. Push the new secret to the device in the same maintenance step.