---
title: "Revoke every outstanding v2 dossier share link for the org"
method: POST
path: "/v1/orgs/{org_id}/verification-links/rotate"
---

# Revoke every outstanding v2 dossier share link for the org

`POST /v1/orgs/{org_id}/verification-links/rotate`

## Request

- Base URL: `https://api.decionis.com`
- URL: `https://api.decionis.com/v1/orgs/{org_id}/verification-links/rotate`
- Auth: HTTP bearer

v2 dossier share links are signed with a per-org derived secret;
bumping the org's secret version invalidates every v2 link the org has
ever minted — one org, one bump, nothing global. Freshly minted links
use the new version. Revoking every outstanding share link is an admin
act: requires an org API key with the ADMIN role. 5 requests per
minute.

## Path parameters

- `org_id` string, uuid, required

## Response `200`

Secret version bumped; all previously issued v2 links are dead

- OrgVerificationLinkRotationResponse
  - `rotated` boolean, required
  - `verification_link_secret_version` integer, required: The new per-org secret version; freshly minted links use it.
  - `message` string

## Other responses

- `400`: Structured API error
- `401`: Structured API error
- `403`: Structured API error
- `404`: Structured API error

---

[API](https://skmtc.dev/decionis/apis/decionis-policy-evaluation-api.md) · [All operations](https://skmtc.dev/decionis/apis/decionis-policy-evaluation-api/llms.txt) · [OpenAPI document](https://skmtc.dev/decionis/apis/decionis-policy-evaluation-api/revisions/357f5e459d0c?raw)