---
title: "Roll team API client token REST API | HitKeep"
description: "Reference for the HitKeep REST API operation Roll team API client token, including request parameters, responses, and authentication notes."
canonical: "https://hitkeep.com/api/operations/apiuserteamsidapi-clientsclientidrotate/"
---

# Roll team API client token REST API

POST

/api/user/teams/{id}/api-clients/{clientId}/rotate

FetchcURL

```
const url = 'http://127.0.0.1:25737/api/user/teams/2489E9AD-2EE2-8E00-8EC9-32D5F69181C0/api-clients/2489E9AD-2EE2-8E00-8EC9-32D5F69181C0/rotate';
const options = {method: 'POST', headers: {cookie: 'hk_token=<hk_token>'}};

try {
  const response = await fetch(url, options);
  const data = await response.json();
  console.log(data);
} catch (error) {
  console.error(error);
}
```

```
curl --request POST \
  --url http://127.0.0.1:25737/api/user/teams/2489E9AD-2EE2-8E00-8EC9-32D5F69181C0/api-clients/2489E9AD-2EE2-8E00-8EC9-32D5F69181C0/rotate \
  --cookie hk_token=<hk_token>
```

-

Generates a new one-time token for an active team-owned API client and immediately invalidates the previous token.

## Authorizations

- **[cookieAuth](https://hitkeep.com/api/#cookieauth)**

## Parameters

### Path Parameters

**id**

required

string format: uuid

**clientId**

required

string format: uuid

## Responses

### 200

Rolled team API client token

application/json

object

**client**

object

**created_at**

string format: date-time

**description**

string

**expires_at**

string format: date-time

**id**

string format: uuid

**instance_role**

string

**last_used_at**

string format: date-time

**name**

string

**owner_type**

string

Allowed values: personal team

**revoked_at**

string format: date-time

**site_roles**

Explicit site grants. Empty means the API client has no site-scoped analytics, MCP, or ingest access.

Array<object>

object

**role**

string

**site_id**

string format: uuid

**tenant_id**

string format: uuid

**updated_at**

string format: date-time

**user_id**

string format: uuid

**token**

string

##### Example

```
{
  "client": {
    "owner_type": "personal"
  }
}
```

### 409

API client is revoked or expired

[Previous Delete team API client](https://hitkeep.com/api/operations/apiuserteamsidapi-clientsclientid/delete/)[Next Archive team](https://hitkeep.com/api/operations/apiuserteamsidarchive/)