---
title: "Rotate a personal access token"
method: POST
path: "/api/v4/personal_access_tokens/{id}/rotate"
tags: ["access_tokens"]
---

# Rotate a personal access token

`POST /api/v4/personal_access_tokens/{id}/rotate`

## Request

- Base URL: `https://gitlab.com`
- URL: `https://gitlab.com/api/v4/personal_access_tokens/{id}/rotate`
- Auth: none declared

Rotates a specified personal access token. This revokes the previous token and creates a token that expires after one week. Administrators can revoke tokens for any user. Non-administrators can only revoke their own tokens.

## Path parameters

- `id` integer, required

## Request body

- PostApiV4PersonalAccessTokensIdRotate: Rotate a personal access token
  - `expires_at` string, date: The expiration date of the token

## Response `201`

Rotate a personal access token

- APIEntitiesPersonalAccessTokenWithToken: API_Entities_PersonalAccessTokenWithToken model
  - `id` integer, required
  - `name` string, required
  - `revoked` boolean, required
  - `created_at` string, date-time, required
  - `description` string, required
  - `scopes` unknown[], required
    - unknown
  - `user_id` integer, required
  - `last_used_at` string, date-time, required
  - `last_used_ips` string[], required: The five most recent unique IP addresses that have authenticated with this token. When the limit is reached, the oldest IP address is removed. The list updates once per minute per token.
  - `active` boolean, required
  - `granular` boolean, required
  - `granular_scopes` APIEntitiesPersonalAccessTokenGranularScope[]
    - `access` string, required
    - `permissions` unknown[], required
      - unknown
    - `project_id` integer, required
    - `group_id` integer, required
  - `expires_at` string, date-time, required
  - `token` string, required

---

[API](https://skmtc.dev/gitlab/apis/gitlab-api.md) - [All operations](https://skmtc.dev/gitlab/apis/gitlab-api/llms.txt) - [OpenAPI document](https://skmtc.dev/gitlab/apis/gitlab-api/revisions/b234947ef3f2?raw)