---
title: "Re-issue audit token"
method: POST
path: "/v1/transactions/{id}/audit-token"
tags: ["transactions"]
---

# Re-issue audit token

`POST /v1/transactions/{id}/audit-token`

## Request

- Base URL: `https://api.strale.io`
- URL: `https://api.strale.io/v1/transactions/{id}/audit-token`
- Auth: HTTP bearer

Issue a new HMAC-signed audit URL for a transaction you own. Replaces the previous token for the caller's convenience; previous tokens remain valid until their own expires_at (stateless). Default TTL 90 days (F-A-006). Caller must own the transaction (same 404 for unknown / cross-user / deleted).

## Path parameters

- `id` string, uuid, required

## Request body

- object
  - `expires_in_days` integer: TTL for the new token in days. Integer 1-365. Default 90.

## Response `200`

Audit token re-issued.

- object
  - `transaction_id` string, uuid
  - `token` string: 32-char HMAC-SHA256 substring.
  - `expires_at` integer: Unix seconds.
  - `expires_at_iso` string, date-time
  - `audit_url` string: Full shareable URL with token + expires_at query params.

## Other responses

- `400`: expires_in_days must be an integer between 1 and 365.
- `401`: Missing or invalid API key.
- `404`: Transaction not found.

---

[API](https://skmtc.dev/strale/apis/strale-api-2.md) · [All operations](https://skmtc.dev/strale/apis/strale-api-2/llms.txt) · [OpenAPI document](https://skmtc.dev/strale/apis/strale-api-2/revisions/a5293878cfc6?raw)