---
title: "POST /api/v1/agent-vault/proxies/{proxyId}/token-auth/proxy-token"
method: POST
path: "/api/v1/agent-vault/proxies/{proxyId}/token-auth/proxy-token"
tags: ["Agent Vault Proxies"]
---

# POST /api/v1/agent-vault/proxies/{proxyId}/token-auth/proxy-token

`POST /api/v1/agent-vault/proxies/{proxyId}/token-auth/proxy-token`

## Request

- Base URL: `https://us.infisical.com`
- URL: `https://us.infisical.com/api/v1/agent-vault/proxies/{proxyId}/token-auth/proxy-token`
- Auth: none declared

Issue a new proxy token. The proxy's earlier tokens stop working and it gets a new certificate authority.

## Path parameters

- `proxyId` string, uuid, required

## Response `200`

Default Response

- object
  - `proxy` object, required
    - `id` string, uuid, required: The ID of the proxy.
    - `name` string, required: The name of the proxy.
    - `heartbeat` string, date-time, nullable, required: When the proxy last checked in, or `null` if it never has.
    - `isHealthy` boolean, required: Whether the proxy has checked in recently enough to be considered up.
    - `rootCaFingerprint` string, nullable, required: The SHA-256 fingerprint of the proxy's certificate authority. Pin this if you want to verify the proxy an agent connects to.
    - `rootCaExpiresAt` string, date-time, nullable, required: When the proxy's certificate authority expires.
    - `trafficPolicy` 'any-host' | 'bundle-hosts', required: Which hosts an agent may reach through this proxy. `any-host` lets every request out; `bundle-hosts` allows only hosts an access bundle covers, plus anything in `allowedHosts`, and refuses the rest with a 403.
    - `allowedHosts` string, nullable, required: Hosts that stay reachable under the `bundle-hosts` traffic policy even though no access bundle covers them. Still intercepted, and given no credential.
    - `pollInterval` number, required: How often, in seconds, the proxy refreshes its sessions and settings. Between 10 and 300.
    - `createdAt` string, date-time, required: When the proxy was registered.
  - `proxyToken` string, required: The token the proxy starts with, on as many machines as you need. Shown once, and works until it is rotated or the proxy's access is revoked.

## Other responses

- `400`: Default Response
- `401`: Default Response
- `403`: Default Response
- `404`: Default Response
- `422`: Default Response
- `500`: Default Response

## Changes

- **2026-10-23** `5b6ee494a4bf`: 1 info
  - endpoint added

[Operation history](https://skmtc.dev/infisical/apis/infisical-api/changes/api/v1/agent-vault/proxies/:proxyId/token-auth/proxy-token/post.md)

---

[API](https://skmtc.dev/infisical/apis/infisical-api.md) - [All operations](https://skmtc.dev/infisical/apis/infisical-api/llms.txt) - [OpenAPI document](https://skmtc.dev/infisical/apis/infisical-api/revisions/7f940199c899?raw)