---
title: "Update token"
method: PUT
path: "/v2/storage/tokens/{id}"
tags: ["Tokens and Permissions"]
---

# Update token

`PUT /v2/storage/tokens/{id}`

## Request

- Base URL: `https://connection.keboola.com`
- URL: `https://connection.keboola.com/v2/storage/tokens/{id}`
- Auth: one of:
  - API key in header `X-StorageApi-Token`
  - API key in header `X-KBC-ManageApiToken`
  - HTTP bearer
- TypeScript: <https://skmtc.dev/keboola/apis/keboola-storage-api/docs/v2/storage/tokens/:id/put.ts> (a function with typed inputs; its response is checked against the schema)

Updates token properties. Beware that all current bucket permissions are replaced. If you want to add new
bucket permissions, don't forget to specify the previous permissions.

## Path parameters

- `id` integer, required

## Request body

- UpdateTokenRequest
  - `description` string, nullable: Token description.
  - `bucketPermissions` object: Permissions per bucket, keyed by bucket ID. Available permissions: `read`, `write`. All current bucket permissions are replaced.
  - `componentAccess` string[], nullable: Grants access for component configurations. Allowed values are valid component IDs.
  - `canReadAllFileUploads` boolean, nullable: Allows access to all file uploads. When set to false, only files uploaded by the current token are accessible.
  - `canPurgeTrash` boolean, nullable: Allows permanently removing deleted configurations.

## Response `200`

Updated token. The decrypted `token` value is never returned.

- TokenCreateResponse
  - `id` string, required: Unique identifier of the token.
  - `created` string, nullable, required: Token creation timestamp, ISO 8601 with a `+hhmm` offset.
  - `refreshed` string, nullable, required: Token last refresh timestamp, ISO 8601 with a `+hhmm` offset.
  - `description` string, required: User-provided description of the token.
  - `uri` string, required: URI of the token detail.
  - `isMasterToken` boolean, required: Whether this is a master (admin) token.
  - `canManageBuckets` boolean, required: Token permission to manage all buckets.
  - `canManageTokens` boolean, required: Token permission to manage tokens.
  - `canReadAllFileUploads` boolean, required: Token permission to read all file uploads.
  - `canPurgeTrash` boolean, required: Token permission to permanently remove deleted configurations.
  - `canManageProtectedDefaultBranch` boolean, required: Token permission to manage the protected default branch.
  - `canCreateJobs` boolean, required: Token permission to create jobs.
  - `canReadAllProjectEvents` boolean, required: Token permission to read all project events.
  - `canManageDevBranches` boolean, required: Token permission to manage development branches.
  - `expires` string, nullable, required: Expiration timestamp of the token, ISO 8601 with a `+hhmm` offset; null when the token never expires.
  - `isExpired` boolean, required: Whether the token is expired.
  - `isDisabled` boolean, required: Whether the token is disabled.
  - `dailyCapacity` integer, required: Daily capacity of the token.
  - `token` string: Decrypted token value. Present only in the create response; omitted on update.
  - `creatorToken` object: Token that created this token. Present only when the token was created by another token.
    - `id` integer, required: ID of the creator token.
    - `description` string, required: Description of the creator token.
  - `actor` ActorResponse, required: Who performed the action and through which credential.
    - `type` 'token' | 'session' | 'pat' | 'system', required: Credential the action came through: a Storage token, a programmatic session, a personal access token, or system work.
    - `id` string, required: Token id as a string, session or personal access token UUID, or the system subject.
    - `name` string, required: Token description, the admin email for a session or personal access token, or the system label, as it was when the action happened.
    - `adminId` integer, nullable, required: Admin behind the credential; null for a token without an admin, for system work, and when the admin was not recorded (an object whose creator is known only from its token columns, including rows backfilled from them).
  - `componentAccess` string[]: Component IDs the token may access. Present only when at least one component is granted.
  - `bucketPermissions` object, required: Bucket permissions keyed by bucket ID (`read`, `write` or `manage`).

## Other responses

- `400`: Invalid request body (`storage.tokens.validation`) or invalid bucket/component permissions (`storage.tokens.invalidPermissions`).
- `403`: The authorizing token may not manage tokens (`accessDenied`).
- `404`: Token not found (`storage.tokens.notFound`).

---

[API](https://skmtc.dev/keboola/apis/keboola-storage-api.md) - [All operations](https://skmtc.dev/keboola/apis/keboola-storage-api/llms.txt) - [OpenAPI document](https://skmtc.dev/keboola/apis/keboola-storage-api/revisions/34b5ceac0317?raw)