---
title: "Rotate the agent API token — plaintext returned ONCE"
method: POST
path: "/api/workspaces/{workspaceId}/agents/{agentId}/token"
tags: ["Agents"]
---

# Rotate the agent API token — plaintext returned ONCE

`POST /api/workspaces/{workspaceId}/agents/{agentId}/token`

## Request

- Base URL: `https://hiveship.app/api`
- URL: `https://hiveship.app/api/api/workspaces/{workspaceId}/agents/{agentId}/token`
- Auth: API key in cookie `hiveship_access`

Generates a new Bearer token for the agent and replaces any previous one. The plaintext `token` is returned once in the response body and is never retrievable again; only its bcrypt hash is persisted. OWNER/ADMIN only.

## Path parameters

- `workspaceId` string, required
- `agentId` string, required

## Response `200`

Token rotated; plaintext returned

- object
  - `success` boolean, required
  - `data` object, required
    - `token` string, required
    - `hint` string, required
    - `rotatedAt` string, date-time, required

## Other responses

- `403`: Insufficient permissions
- `404`: Agent not found

---

[API](https://skmtc.dev/hiveship/apis/hiveship-api.md) · [All operations](https://skmtc.dev/hiveship/apis/hiveship-api/llms.txt) · [OpenAPI document](https://skmtc.dev/hiveship/apis/hiveship-api/revisions/73d3e26544e4?raw)