v4

latestOpenAPI 3.0.3raw.githubusercontent.com2026-06-279228.8 KB
Access Tokens

Rotate access token

Generates a new raw token for an existing access token and invalidates the previous raw token immediately. The token id, name, description, permission, will_expire, and expired_at values are preserved.

Requires auth_enabled=true and an admin access token or admin JWT. Expired tokens cannot be rotated.

post/auth/api_key/{token_id}/rotate

Path parameters

token_idinteger required

The unique identifier of the access token to rotate.

Headers

Authorizationstring required

Admin JWT or admin access token. Format Bearer <admin-jwt-or-access-token>.

Response

Token rotated successfully. Returns the new raw token.

idinteger

Unique identifier for the access token.

namestring

Human-readable name for the token.

descriptionstring

Description of the token's intended use.

api_keystring

The new raw API key value. Store this securely, as it cannot be retrieved after rotation.

created_atstring date-time

Original creation timestamp, in RFC 3339 UTC format.

expired_atstring date-time nullable

Expiration timestamp. null when will_expire is false.

will_expireboolean

Whether the token has an expiration date.

permissionstring

Comma-separated permission names assigned to the token.