---
title: "Refresh token"
method: POST
path: "/v2/storage/tokens/{id}/refresh"
tags: ["Tokens and Permissions"]
---

# Refresh token

`POST /v2/storage/tokens/{id}/refresh`

## Request

- Base URL: `https://connection.keboola.com`
- URL: `https://connection.keboola.com/v2/storage/tokens/{id}/refresh`
- Auth: one of:
  - API key in header `X-StorageApi-Token`
  - API key in header `X-KBC-ManageApiToken`
  - HTTP bearer
- TypeScript: <https://skmtc.dev/keboola/apis/keboola-storage-api/docs/v2/storage/tokens/:id/refresh/post.ts> (a function with typed inputs; its response is checked against the schema)

Generates a new token value; the old token value becomes immediately invalid.
Any token can refresh itself, except a read-only personal access token; refreshing another token
requires the `canManageTokens` permission.

The decrypted `token` value is returned when refreshing a non-master token, the token used for authorization,
or when the project has a dedicated project feature enabled.

## Path parameters

- `id` integer, required

## Response `200`

Refreshed token.

- TokenRefreshResponse
  - `id` string, required: Unique identifier of the token.
  - `created` string, nullable, required: Token creation timestamp, ISO 8601 with a `+hhmm` offset.
  - `refreshed` string, nullable, required: Token last refresh timestamp, ISO 8601 with a `+hhmm` offset.
  - `description` string, required: User-provided description of the token.
  - `uri` string, required: URI of the token detail.
  - `isMasterToken` boolean, required: Whether this is a master (admin) token.
  - `canManageBuckets` boolean, required: Token permission to manage all buckets.
  - `canManageTokens` boolean, required: Token permission to manage tokens.
  - `canReadAllFileUploads` boolean, required: Token permission to read all file uploads.
  - `canPurgeTrash` boolean, required: Token permission to permanently remove deleted configurations.
  - `canManageProtectedDefaultBranch` boolean, required: Token permission to manage the protected default branch.
  - `canCreateJobs` boolean, required: Token permission to create jobs.
  - `canReadAllProjectEvents` boolean, required: Token permission to read all project events.
  - `canManageDevBranches` boolean, required: Token permission to manage development branches.
  - `expires` string, nullable, required: Expiration timestamp of the token, ISO 8601 with a `+hhmm` offset; null when the token never expires.
  - `isExpired` boolean, required: Whether the token is expired.
  - `isDisabled` boolean, required: Whether the token is disabled.
  - `dailyCapacity` integer, required: Daily capacity of the token.
  - `token` string: Decrypted token value. Present only for non-master tokens, for the token used for authorization, or when the project has a dedicated project feature enabled.
  - `creatorToken` object: Token that created this token. Present only when the token was created by another token.
    - `id` integer, required: ID of the creator token.
    - `description` string, required: Description of the creator token.
  - `actor` ActorResponse, required: Who performed the action and through which credential.
    - `type` 'token' | 'session' | 'pat' | 'system', required: Credential the action came through: a Storage token, a programmatic session, a personal access token, or system work.
    - `id` string, required: Token id as a string, session or personal access token UUID, or the system subject.
    - `name` string, required: Token description, the admin email for a session or personal access token, or the system label, as it was when the action happened.
    - `adminId` integer, nullable, required: Admin behind the credential; null for a token without an admin, for system work, and when the admin was not recorded (an object whose creator is known only from its token columns, including rows backfilled from them).
  - `componentAccess` string[]: Component IDs the token may access. Present only when at least one component is granted.
  - `bucketPermissions` object, required: Bucket permissions keyed by bucket ID (`read`, `write` or `manage`).

## Other responses

- `403`: The authorizing token may not refresh this token (`accessDenied`), or the request uses a credential issued by agent provisioning (`storage.tokens.agentCredentialNotAllowed`).
- `404`: Token not found (`storage.tokens.notFound`).

---

[API](https://skmtc.dev/keboola/apis/keboola-storage-api.md) - [All operations](https://skmtc.dev/keboola/apis/keboola-storage-api/llms.txt) - [OpenAPI document](https://skmtc.dev/keboola/apis/keboola-storage-api/revisions/34b5ceac0317?raw)