---
title: "Rotate a repository's token [write]"
method: POST
path: "/sessions/{id}/resources/{rid}"
tags: ["sessions"]
---

# Rotate a repository's token \[write\]

`POST /sessions/{id}/resources/{rid}`

## Request

- Base URL: `https://api.agentsky.dev/v1`
- URL: `https://api.agentsky.dev/v1/sessions/{id}/resources/{rid}`
- Auth: HTTP bearer

Only `github_repository` resources accept an update, and the token is the only field: it is re-encrypted and the session's egress policy is recompiled and pushed to its live pod — nothing changes inside the sandbox. A file or memory store answers 400. A token that conflicts with another secret's Authorization header on github.com answers 400 egress_header_conflict.

## Path parameters

- `id` string, required
- `rid` string, required

## Request body

- UpdateSessionResource
  - `authorization_token` string, required

## Response `200`

OK

- union: A file, GitHub repository, or memory-store snapshot mounted read-only into the session. A read_write memory-store grant also permits updates through the session-scoped Agent API. Workspace paths are under /workspace; memory paths are under /mnt/memory. A file resource's `file_id` is the per-session copy (listed under GET /files?scope_id=). Repository tokens and memory contents are never echoed here.
  - object
    - `type` 'file', required
    - `id` string, required: sesrsc_…
    - `file_id` string, required: The per-session copy (file_…), read-only at mount_path
    - `mount_path` string, required: Absolute, under /workspace
    - `created_at` string, date-time, required
    - `updated_at` string, date-time, required
  - object
    - `type` 'github_repository', required
    - `id` string, required: sesrsc_…
    - `url` string, required: https://github.com/{owner}/{repo}
    - `mount_path` string, required: Absolute, under /workspace; the clone's root
    - `checkout` object: {type:"branch", name} or {type:"commit", sha}; absent = the default branch
      - `type` 'branch' | 'commit'
      - `name` string
      - `sha` string
    - `created_at` string, date-time, required
    - `updated_at` string, date-time, required
  - object
    - `type` 'memory_store', required
    - `id` string, required: smsr_…
    - `memory_store_id` string, required: memstore_…
    - `mount_path` string, required: Absolute, under /mnt/memory
    - `access` 'read_only' | 'read_write', required
    - `instructions` string: Optional per-session guidance
    - `created_at` string, date-time, required
    - `updated_at` string, date-time, required

## Other responses

- `default`: Error — { error: { code, message } }

## Changes

- **2026-11-02** `e5e8f0229a99`: 1 info
  - added the optional property `error/request_id` to the response with the `default` status

[Operation history](https://skmtc.dev/agentsky/apis/agentsky-developer-api/changes/sessions/:id/resources/:rid/post.md)

---

[API](https://skmtc.dev/agentsky/apis/agentsky-developer-api.md) - [All operations](https://skmtc.dev/agentsky/apis/agentsky-developer-api/llms.txt) - [OpenAPI document](https://skmtc.dev/agentsky/apis/agentsky-developer-api/revisions/0d435187cd55?raw)