---
title: "Rotate Code"
method: POST
path: "/tenants/{id}/code"
tags: ["tenants"]
---

# Rotate Code

`POST /tenants/{id}/code`

## Request

- Base URL: `https://api.instruxi.dev/api/v1/enforcer`
- URL: `https://api.instruxi.dev/api/v1/enforcer/tenants/{id}/code`
- Auth: one of:
  - API key in header `Authorization`
  - API key in header `X-API-Key`

Replaces the tenant's join code with a freshly generated one and returns it in the response body (the only time the new value is shown in full). The OLD code stops working immediately for anyone trying to join with it: every join link and any invite text that embeds the old code goes stale, so this is a "the help-desk is about to get join-code tickets" action, not a routine rotation. The body is optional; when present it must be `application/json` with only `expires_at` (RFC 3339, in the future), or the call is a 400 and the code is not rotated. `expires_at` makes the new code stop resolving at that time everywhere a code is accepted, exactly as if it had been rotated away: new joins AND sign-in by code. Existing members who name the workspace by its code (the OAuth sign-in page, or any auth route given `tenant_code`) cannot sign in that way until an admin rotates again; SSO, Privy app sign-in and existing sessions are unaffected. Those routes answer 404 `tenant_code_expired`. Omitted, the code never expires. Each rotation sets the expiry afresh, and rotating is the only way to change it.

## Path parameters

- `id` string, required

## Request body

- InternalDeliveryHttpHandlerRotateCodeRequest
  - `expires_at` string: ExpiresAt is when the new code stops working (RFC 3339, in the future). Omitted or null: the code never expires, as before.

## Response `200`

OK

- InternalDeliveryHttpHandlerTenantCodeResponse
  - `data` InternalDeliveryHttpHandlerTenantCode
    - `code` string
    - `expires_at` string: ExpiresAt echoes the expiry the rotation set; absent = never expires.
    - `id` string
  - `success` boolean

## Other responses

- `400`: Bad Request
- `401`: Unauthorized
- `403`: Forbidden
- `404`: Not Found

---

[API](https://skmtc.dev/instruxi/apis/enforcer-api.md) · [All operations](https://skmtc.dev/instruxi/apis/enforcer-api/llms.txt) · [OpenAPI document](https://skmtc.dev/instruxi/apis/enforcer-api/revisions/fa82bc1becc0?raw)