---
title: "Rotate a machine access credential"
method: POST
path: "/v1/spaces/{spaceId}/machine-credentials/{credentialId}/rotate"
tags: ["Access"]
---

# Rotate a machine access credential

`POST /v1/spaces/{spaceId}/machine-credentials/{credentialId}/rotate`

## Request

- Base URL: `https://api.spacefast.com`
- URL: `https://api.spacefast.com/v1/spaces/{spaceId}/machine-credentials/{credentialId}/rotate`
- Auth: HTTP bearer

Replaces the opaque bearer token and invalidates the previous token while preserving its canonical grant.

## Path parameters

- `spaceId` string, required
- `credentialId` string, required

## Response `200`

Response for status 200

- object
  - `$schema` string, uri: Canonical JSON Schema URL for this response body. The server also sends it in the `Link: rel="describedby"` response header.
  - `data` object, required
    - `credential` object, required
      - `id` string, required
      - `grant` object, required
        - `grant` object, required
          - `name` string
          - `audience` union, required
            - object
              - …
            - object
              - …
            - object
              - …
            - object
              - …
            - object
              - …
            - object
              - …
            - object
              - …
          - `resources` object, required
            - `include` string[], required
            - `exclude` string[], required
          - `capabilities` string[], required
          - `constraints` object, required
            - `notBefore` union
              - …
            - `expiresAt` union
              - …
            - `maxUses` integer
            - `requireVerifiedEmail` boolean
            - `network` object
              - …
            - `frameOrigin` string
          - `target` union, required
            - object
              - …
            - object
              - …
            - object
              - …
            - object
              - …
          - `id` string, required
          - `source` object, required
            - `kind` 'config' | 'managed' | 'system', required
            - `reference` string, required
        - `generation` integer, required
        - `status` 'scheduled' | 'active' | 'expired', required
        - `sourceExplanation` object, required
          - `editable` boolean, required
          - `label` string, required
          - `detail` string, required
        - `createdAt` string, date-time, required
        - `updatedAt` string, date-time, required
      - `tokenHint` string, required
      - `rotatedAt` string, date-time, nullable, required
      - `lastUsedAt` string, date-time, nullable, required
      - `revokedAt` string, date-time, nullable, required
    - `token` string, required

## Other responses

- `default`: Problem details (RFC 9457). Any 4xx/5xx response is one `application/problem+json` document.

---

[API](https://skmtc.dev/spacefast/apis/spacefast-api.md) · [All operations](https://skmtc.dev/spacefast/apis/spacefast-api/llms.txt) · [OpenAPI document](https://skmtc.dev/spacefast/apis/spacefast-api/revisions/bd165bc7c983?raw)