---
title: "Replace one API token while preserving its permissions and scope"
method: POST
path: "/api/tokens/roll"
tags: ["Clients and tokens"]
---

# Replace one API token while preserving its permissions and scope

`POST /api/tokens/roll`

## Request

- Base URL: `https://keep.md`
- URL: `https://keep.md/api/tokens/roll`
- Auth: API key in cookie `keep.session_token`

Replace one API token while preserving its permissions and scope.

## Query parameters

- `type` 'personal'

## Headers

- `Keep-API-Version` string

## Request body

- object
  - `id` string

## Response `200`

Replacement API token

- ApiToken
  - `id` string, required
  - `type` 'personal', required
  - `tokenType` 'personal'
  - `token` string: Returned only when a credential is created or rolled.
  - `name` string, nullable
  - `permissions` string[]
  - `scopeVersion` integer
  - `resourceScope` ResourceScope
    - `tagSlugs` string[]
    - `collectionIds` string[]
  - `tokenPrefix` string
  - `tokenSuffix` string
  - `createdAt` integer, required
  - `updatedAt` integer
  - `lastUsedAt` integer, nullable

## Other responses

- `400`: Invalid request
- `401`: Authentication required
- `403`: The credential lacks access or the plan does not include the feature
- `404`: Resource not found

---

[API](https://skmtc.dev/keep/apis/keep-api.md) · [All operations](https://skmtc.dev/keep/apis/keep-api/llms.txt) · [OpenAPI document](https://skmtc.dev/keep/apis/keep-api/revisions/a338a455bd0f?raw)