> ## Documentation Index
> Fetch the complete documentation index at: https://docs.erdo.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# Replace an active API token atomically, without changing its grants.


> Only the key's OWNER may rotate it. An admin of the owner's home organization can revoke a member's key but not rotate it, because the replacement acts as the owner and its secret is returned to the caller. Owner, default organization, access mode, capabilities and resource slugs are preserved; the original lifetime starts again from the time of rotation, capped at 36500 days. The new secret is returned once, and the old key stops working immediately. Scoped and read-only credentials cannot perform rotation.




## OpenAPI

````yaml /api/openapi.json post /v1/tokens/{tokenID}/rotate
openapi: 3.0.0
info:
  title: Erdo API
  description: >-
    Erdo's REST API: query and write datasets, run agents, manage threads,
    integrations, pages, evals, workstreams, experiments, and bounded outreach.
    Authenticate with a Bearer API key (erdo_api_...) or scoped token
    (erdo_token_...).
  version: '2026-10-23'
servers:
  - url: https://api.erdo.ai
    description: Production
security:
  - bearerAuth: []
paths:
  /v1/tokens/{tokenID}/rotate:
    post:
      summary: |
        Replace an active API token atomically, without changing its grants.
      description: >
        Only the key's OWNER may rotate it. An admin of the owner's home
        organization can revoke a member's key but not rotate it, because the
        replacement acts as the owner and its secret is returned to the caller.
        Owner, default organization, access mode, capabilities and resource
        slugs are preserved; the original lifetime starts again from the time of
        rotation, capped at 36500 days. The new secret is returned once, and the
        old key stops working immediately. Scoped and read-only credentials
        cannot perform rotation.
      operationId: POST:mcp.RotateTokenAPI
      parameters:
        - allowEmptyValue: true
          explode: false
          in: path
          name: tokenID
          required: true
          schema:
            type: string
          style: simple
      responses:
        '200':
          content:
            application/json:
              schema:
                properties:
                  access:
                    title: |
                      Access is the key's access mode: "full" or "read".
                    type: string
                  capabilities:
                    description: |
                      (absent for unscoped keys).
                    items:
                      type: string
                    title: >
                      Capabilities/ResourceSlugs echo the scoping the key was
                      minted with
                    type: array
                  default_org:
                    $ref: '#/components/schemas/mcp.TokenOrg'
                  expires_at:
                    type: string
                  hint:
                    type: string
                  id:
                    type: string
                  is_scoped:
                    description: |
                      allowlist is empty.
                    title: >
                      IsScoped is true for a scoped key, including one whose
                      capability
                    type: boolean
                  replaced_token_id:
                    description: |
                      the rotation committed.
                    title: >
                      ReplacedTokenID is the ID of the old key, which stopped
                      working the moment
                    type: string
                  resource_slugs:
                    items:
                      type: string
                    type: array
                  token:
                    title: >
                      Token is the raw secret, returned ONCE. Store it now; it
                      is never shown again.
                    type: string
                type: object
          description: Success response
        default:
          $ref: '#/components/responses/APIError'
components:
  schemas:
    mcp.TokenOrg:
      properties:
        id:
          type: string
        name:
          type: string
      type: object
  responses:
    APIError:
      content:
        application/json:
          schema:
            externalDocs:
              url: https://pkg.go.dev/encore.dev/beta/errs#Error
            properties:
              code:
                description: Error code
                example: not_found
                externalDocs:
                  url: https://pkg.go.dev/encore.dev/beta/errs#ErrCode
                type: string
              details:
                description: Error details
                type: object
              message:
                description: Error message
                type: string
            title: APIError
            type: object
      description: Error response
  securitySchemes:
    bearerAuth:
      type: http
      scheme: bearer
      description: An Erdo API key (erdo_api_...) or scoped token (erdo_token_...).

````

This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.