Rotate a site's FraseCMS delivery token

Mints a brand-new headless delivery token for the site and returns it. Destructive and IRREVERSIBLE: a fresh random per-site secret is generated and the site's delivery-token version is incremented in a single update, so EVERY previously issued token for this site stops verifying the moment this call succeeds. There is no un-rotate — update every consumer with the returned token. The new token itself is not lost if you miss the response: while it is live you can read the same string back from GET /sites/{siteId}/cms-token (it is re-derived from the stored secret). What is gone forever is the old token. Gates: requires the write:content scope (note the sibling GET requires write:sites instead). Takes no request body — anything sent is ignored. An org-scoped bucket allows 10 rotations per hour per organization; exceeding it returns a data-wrapped 429 with no Retry-After header. Unlike the GET, this response does NOT set Cache-Control: no-store even though it carries a live credential — do not cache or log it. Success is recorded in analytics as a rotation for the site. OPTIONS is supported for CORS preflight (204, Access-Control-Allow-Methods: POST, OPTIONS).

post/sites/{siteId}/cms-token/rotate

Request

Base URL: https://next.frase.io/api/v1
URL: https://next.frase.io/api/v1/sites/{siteId}/cms-token/rotate
Auth: API key in header X-API-KEY

Path parameters

siteIdstring uuid required

Site ID. Must be a UUID and must be owned by your organization.

Response

Rotated. The old token is already invalid.

Example response

{
  "data": {
    "token": "fcms_ZXhhbXBsZToy..."
  }
}

Changes

No recorded changes to this operation across all 1 revision of this API.