---
title: "Transfer a right (re-keying: new code issued, old code invalidated; no auth)"
method: POST
path: "/api/rightos/tokens/{tokenId}/transfer"
tags: ["tokens"]
---

# Transfer a right (re-keying: new code issued, old code invalidated; no auth)

`POST /api/rightos/tokens/{tokenId}/transfer`

## Request

- Base URL: `https://rightos.i-s3.com`
- URL: `https://rightos.i-s3.com/api/rightos/tokens/{tokenId}/transfer`
- Auth: none required

Only the current holder (who knows the current verificationCode) can transfer. A new code is issued and the old one is invalidated immediately. Paid transfers/auctions are not offered. Rate limited like verify. Subject to the location's policy: returns 409 with error policy_transfer_disabled when the location forbids transfers, or transfer_limit_reached when maxTransfers is exhausted.

## Path parameters

- `tokenId` string, required

## Request body

- object
  - `verificationCode` string, required: Current code, proving transfer authority

## Response `200`

New code and wallet URL for the new holder (returned exactly once)

- IssuedTokenResponse
  - `token` RightToken: Public Right Token. The secretHash is never exposed by any endpoint.
    - `id` string
    - `organizationId` string
    - `locationId` string
    - `title` string
    - `description` string
    - `startTime` string, date-time
    - `endTime` string, date-time
    - `priorityNumber` integer: Daily issue sequence at this location (includes cancelled/used/expired). Not the live queue position — see queuePosition
    - `queuePosition` integer: Position in the active queue at issuance (issued + verified, not expired). ADR-0024
    - `status` 'issued' | 'verified' | 'used' | 'cancelled' | 'expired'
    - `transferCount` integer: Number of times transferred. 0 = original holder.
    - `createdAt` string, date-time
    - `usedAt` string, date-time
    - `cancelledAt` string, date-time
    - `transferredAt` string, date-time
  - `verificationCode` string: Returned exactly once. The server stores only its SHA-256 hash and cannot re-issue it.
  - `walletUrl` string: Right Wallet URL (QR display) to hand to the end user.

## Other responses

- `409`: Wrong code or token not transferable
- `429`: Rate limit exceeded (HTTP 429). See Retry-After header. Limits: verify/transfer = 10/min per IP+token and 60/min per IP; signup = 5/hour per IP.

---

[API](https://skmtc.dev/i-s3/apis/rightos-right-api.md) · [All operations](https://skmtc.dev/i-s3/apis/rightos-right-api/llms.txt) · [OpenAPI document](https://skmtc.dev/i-s3/apis/rightos-right-api/revisions/10020536e345?raw)