---
title: "Rotate the share link"
method: POST
path: "/projects/{projectId}/user-testing/scenarios/{scenarioId}/rotate-link"
tags: ["User testing"]
---

# Rotate the share link

`POST /projects/{projectId}/user-testing/scenarios/{scenarioId}/rotate-link`

Mints a new share link and stops the old URL from granting access. Everyone you shared it with needs the new one.

**Rotation does NOT evict anyone who already redeemed the old link.** Their grant is a stored row, not a property of the URL, and it survives rotation — `accessVersion` is deliberately not bumped here. So rotation alone does not undo a leak: rotate to close the door, then `DELETE .../members/{memberIdOrEmail}` for anyone who already walked through it.

Bodyless: the scenario is the whole request, and the new secret is minted server-side by definition.

## Response `200`

The new link.

- ScenarioLinkRotated
  - `id` string, required
  - `projectId` string, required
  - `rotated` true, required
  - `link` string, nullable, required — The NEW share link. The old one stops working immediately.

## Other responses

- `401` — Missing, invalid, revoked, or orphaned key (`UNAUTHORIZED`) — or the **target MCP server** needs an OAuth grant (`OAUTH_REQUIRED`), which is a property of the server, not your key.
- `403` — Key is valid but not allowed to do this.
- `404` — Unknown project, server, or resource.
- `429` — Per-key rate limit exceeded (60 requests/minute sustained, bursts up to 10). Honor `Retry-After` and back off with jitter.
- `500` — Something failed on MCPJam's side.

---

[API](https://skmtc.net/mcpjam/apis/mcpjam-api.md) · [All operations](https://skmtc.net/mcpjam/apis/mcpjam-api/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/mcpjam/mcpjam-api/revisions/8978a4e735fa/schema)