Rotate a service-account token
POST /api/v1/public/tokens/{tokenId}/rotate
POST /api/v1/public/tokens/{tokenId}/rotateCreate or trigger tokens rotate.
Operation ID: post_api_v1_public_tokens_tokenId_rotate.
Authentication
Choose a credential. Each row is an accepted alternative; access also depends on current roles, project bindings, and entitlements.
| Credential | Carrier | OAuth scopes |
|---|---|---|
OAuth2 | Authorization: Bearer | access:write |
Availability
This operation requires the service-account-token-mint capability to be enabled for the deployment. Its presence in the contract does not guarantee availability. See operation availability.
Request parameters
| Name | Location | Required | Type / allowed values | Description / constraints |
|---|---|---|---|---|
tokenId | path | Yes | string | tokenId path parameter; format: uuid; Pattern constrained; see the downloadable schema. |
idempotency-key | header | Yes | string | idempotency-key header parameter; Required canonical UUIDv4 or high-entropy base64url idempotency key; minLength: 22; maxLength: 43; Pattern constrained; see the downloadable schema. |
x-neatlogs-secret-replay-key | header | Yes | any & any | x-neatlogs-secret-replay-key header parameter; Required 32-byte unpadded base64url secret replay key; minLength: 43; maxLength: 43 |
Request body
Body required: yes.
application/json
| Field | Type / allowed values | Required in parent | Description / constraints |
|---|---|---|---|
$ | object | Yes | additionalProperties: false |
expiresInDays | integer | No | default: 90; minimum: 1; maximum: 365 |
name | string | Yes | minLength: 1; maxLength: 255; Pattern constrained; see the downloadable schema. |
scopes | array<"context:read" | "project:write" | "observability:read" | "observability:write" | "evaluation:read" | "evaluation:write" | "configuration:read" | "configuration:write" | "sharing:read" | "sharing:write" | "access:read" | "access:write"> | Yes | minItems: 1; uniqueItems: true |
scopes[] | "context:read" | "project:write" | "observability:read" | "observability:write" | "evaluation:read" | "evaluation:write" | "configuration:read" | "configuration:write" | "sharing:read" | "sharing:write" | "access:read" | "access:write" | Yes | — |
Request example
Replace placeholder IDs and environment variables with values from your authorized project. Credentials are expanded into curl's stdin configuration, not its command arguments. Keep shell tracing off and do not log this configuration. For requests with a body, put a payload matching the schema in request-body.txt; form requests use URL-encoded content.
curl --fail-with-body --silent --show-error --config - <<CURL_CONFIG
request = "POST"
header = "Authorization: Bearer ${NEATLOGS_TOKEN}"
header = "idempotency-key: ${IDEMPOTENCY_KEY}"
header = "x-neatlogs-secret-replay-key: ${X_NEATLOGS_SECRET_REPLAY_KEY}"
header = "Content-Type: application/json"
data-binary = "@request-body.txt"
url = "https://app.neatlogs.com/api/v1/public/tokens/<tokenId>/rotate"
CURL_CONFIGResponses
| Status | Description | Content type |
|---|---|---|
201 | Service-account token rotated | application/json |
400 | Invalid public API request | application/problem+json |
401 | Missing or invalid public API credential | application/problem+json |
403 | Public API request is not authorized | application/problem+json |
404 | Public API resource not found | application/problem+json |
409 | Public API rotation conflict | application/problem+json |
413 | Public API request body too large | application/problem+json |
415 | Unsupported public API request body | application/problem+json |
429 | Public API rate limit exceeded | application/problem+json |
500 | Internal server error | application/problem+json |
503 | Public API credential, project context, or rate limiting unavailable. Backend is draining; retry after the Retry-After delay. | application/problem+json, application/json |
201 response fields
Content type: application/json.
| Field | Type / allowed values | Required in parent | Description / constraints |
|---|---|---|---|
$ | object | Yes | additionalProperties: false |
data | object | Yes | additionalProperties: false |
data.aad | object | Yes | additionalProperties: false |
data.aad.actorId | string | Yes | format: uuid; Pattern constrained; see the downloadable schema. |
data.aad.actorKind | "user" | Yes | — |
data.aad.environment | string | Yes | Pattern constrained; see the downloadable schema. |
data.aad.idempotencyKeyDigest | string | Yes | Pattern constrained; see the downloadable schema. |
data.aad.operationId | "post_api_v1_public_tokens_tokenId_rotate" | Yes | — |
data.aad.orgId | string | Yes | format: uuid; Pattern constrained; see the downloadable schema. |
data.aad.projectId | null | Yes | — |
data.aad.recordId | string | Yes | format: uuid; Pattern constrained; see the downloadable schema. |
data.aad.requestFingerprint | object | Yes | additionalProperties: false |
data.aad.requestFingerprint.digest | string | Yes | Pattern constrained; see the downloadable schema. |
data.aad.requestFingerprint.keyId | string | Yes | Pattern constrained; see the downloadable schema. |
data.aad.requestFingerprint.version | 1 | Yes | — |
data.aad.response | object | Yes | additionalProperties: false |
data.aad.response.contentType | "application/json" | Yes | — |
data.aad.response.schemaVersion | 1 | Yes | — |
data.aad.response.status | 201 | Yes | — |
data.aad.version | 1 | Yes | — |
data.algorithm | "A256GCM" | Yes | — |
data.authTag | string | Yes | minLength: 22; maxLength: 22; Pattern constrained; see the downloadable schema. |
data.ciphertext | string | Yes | minLength: 1; maxLength: 21846; Pattern constrained; see the downloadable schema. |
data.kind | "client_wrapped_secret" | Yes | — |
data.nonce | string | Yes | minLength: 16; maxLength: 16; Pattern constrained; see the downloadable schema. |
data.version | 1 | Yes | — |
requestId | string | Yes | Pattern constrained; see the downloadable schema. |
success | true | Yes | — |
Response headers
| Header | Description / constraints |
|---|---|
RateLimit-Limit | Effective request ceiling for the current window; minimum: 1 |
RateLimit-Remaining | Requests remaining in the current window; minimum: 0 |
RateLimit-Reset | Unix timestamp in seconds when the current window resets; minimum: 0 |
X-NeatLogs-RateLimit-Degraded | Whether bounded emergency enforcement is active; — |
X-NeatLogs-RateLimit-Limit | Effective request ceiling for the current window; minimum: 1 |
X-NeatLogs-RateLimit-Policy | Applied pre-authentication or authenticated rate class; — |
X-NeatLogs-RateLimit-Remaining | Requests remaining in the current window; minimum: 0 |
X-NeatLogs-RateLimit-Reset-After | Whole seconds until the current window resets; minimum: 1 |
X-NeatLogs-RateLimit-Version | NeatLogs rate-limit contract version; — |
X-Request-Id | Server-owned request correlation identifier; Pattern constrained; see the downloadable schema. |
Failures use Problem Details. For exact validation patterns and all response schemas, download the OpenAPI specification.