---
title: "Roll API client token"
method: POST
path: "/api/user/api-clients/{id}/rotate"
tags: ["User"]
---

# Roll API client token

`POST /api/user/api-clients/{id}/rotate`

## Request

- Base URL: `https://demo.hitkeep.com`
- URL: `https://demo.hitkeep.com/api/user/api-clients/{id}/rotate`
- Auth: API key in cookie `hk_token`

Generates a new one-time token for an active delegated API client and immediately invalidates the previous token.

## Path parameters

- `id` string, uuid, required

## Response `200`

Rolled API client token

- APIClientCreateResponse
  - `client` APIClient
    - `created_at` string, date-time
    - `description` string
    - `expires_at` string, date-time
    - `id` string, uuid
    - `instance_role` string
    - `last_used_at` string, date-time
    - `name` string
    - `owner_type` 'personal' | 'team'
    - `revoked_at` string, date-time
    - `site_roles` APIClientSiteRole[]: Explicit site grants. Empty means the API client has no site-scoped analytics, MCP, or ingest access.
      - `role` string
      - `site_id` string, uuid
    - `tenant_id` string, uuid
    - `updated_at` string, date-time
    - `user_id` string, uuid
  - `token` string

## Other responses

- `409`: API client is revoked or expired

---

[API](https://skmtc.dev/hitkeep/apis/hitkeep-rest-api.md) · [All operations](https://skmtc.dev/hitkeep/apis/hitkeep-rest-api/llms.txt) · [OpenAPI document](https://skmtc.dev/hitkeep/apis/hitkeep-rest-api/revisions/bb2df36ab2a4?raw)