---
title: "Rotate a site's FraseCMS delivery token"
method: POST
path: "/sites/{siteId}/cms-token/rotate"
tags: ["Sites"]
---

# Rotate a site's FraseCMS delivery token

`POST /sites/{siteId}/cms-token/rotate`

## Request

- Base URL: `https://next.frase.io/api/v1`
- URL: `https://next.frase.io/api/v1/sites/{siteId}/cms-token/rotate`
- Auth: API key in header `X-API-KEY`

Mints a brand-new headless delivery token for the site and returns it. Destructive and IRREVERSIBLE: a fresh random per-site secret is generated and the site's delivery-token version is incremented in a single update, so EVERY previously issued token for this site stops verifying the moment this call succeeds. There is no un-rotate — update every consumer with the returned token. The new token itself is not lost if you miss the response: while it is live you can read the same string back from GET /sites/{siteId}/cms-token (it is re-derived from the stored secret). What is gone forever is the old token. Gates: requires the `write:content` scope (note the sibling GET requires `write:sites` instead). Takes no request body — anything sent is ignored. An org-scoped bucket allows 10 rotations per hour per organization; exceeding it returns a data-wrapped 429 with no Retry-After header. Unlike the GET, this response does NOT set Cache-Control: no-store even though it carries a live credential — do not cache or log it. Success is recorded in analytics as a rotation for the site. OPTIONS is supported for CORS preflight (204, `Access-Control-Allow-Methods: POST, OPTIONS`).

## Path parameters

- `siteId` string, uuid, required

## Response `200`

Rotated. The old token is already invalid.

- object
  - `data` object
    - `token` string: The new delivery token, `fcms_` + base64url of `siteId:version:hmac`. Use it as the path credential on the FraseCMS read endpoints (`/api/cms/<token>/posts`); the rotate response does not build that URL for you — GET /sites/{siteId}/cms-token returns it as `api_endpoint`.
    - `version` integer: The site's new delivery-token version, one higher than before. Tokens carrying any earlier version no longer verify.

## Other responses

- `400`: Validation failed
- `401`: Authentication failed
- `403`: Forbidden - action not allowed on this resource
- `404`: Resource not found
- `409`: The site is in Trash (`site_deleted`). Terminal and client-actionable — restore the site before rotating; retrying will not clear it. Data-wrapped, and unusually carries a machine-readable `code` alongside the message.
- `429`: Rate limited. Two shapes: the standard API-key limit (Stripe-style error envelope, with Retry-After), or this endpoint's org-scoped rotation bucket of 10/hour, which is data-wrapped and carries NO Retry-After. A refused rotation changes nothing.
- `500`: The rotation failed. Data-wrapped, with a fixed message (`Failed to rotate delivery token`) — v1 routes never leak the underlying error. Re-read the token with GET /sites/{siteId}/cms-token to confirm which version is live before retrying.

---

[API](https://skmtc.dev/frase/apis/frase-api.md) · [All operations](https://skmtc.dev/frase/apis/frase-api/llms.txt) · [OpenAPI document](https://skmtc.dev/frase/apis/frase-api/revisions/7fb75d89f7a4?raw)