> ## Documentation Index
> Fetch the complete documentation index at: https://developers.askparable.com/llms.txt
> Use this file to discover all available pages before exploring further.

# rotateIngestToken

> POST /api/ingest-tokens/{id}/rotate
Rotate an ingest token: mints a replacement for the same tap and puts the
old token into a rotation grace window (expiresAt set server-side) so
senders with the URL registered in a vendor console have time to update.
Returns the new token's plaintext exactly once. Returns 404 if the token
does not exist or belongs to a different workspace.



## OpenAPI

````yaml /api-reference/openapi.json post /api/ingest-tokens/{id}/rotate
openapi: 3.0.3
info:
  title: Parable API
  description: >-
    The REST API for your Parable workspace: manage connectors and taps, explore
    your data catalog, upload artifacts, and administer users and roles.
  version: v1
servers:
  - url: https://api.askparable.com
    description: Production
security: []
paths:
  /api/ingest-tokens/{id}/rotate:
    post:
      tags:
        - ingest-tokens
      summary: rotateIngestToken
      description: >-
        POST /api/ingest-tokens/{id}/rotate

        Rotate an ingest token: mints a replacement for the same tap and puts
        the

        old token into a rotation grace window (expiresAt set server-side) so

        senders with the URL registered in a vendor console have time to update.

        Returns the new token's plaintext exactly once. Returns 404 if the token

        does not exist or belongs to a different workspace.
      operationId: IngestTokensRotateIngestTokenHandler
      parameters:
        - description: >-
            Workspace slug. Overrides subdomain-based workspace resolution when
            provided.
          in: header
          name: X-Tenant
          required: false
          schema:
            example: acme
            type: string
        - description: Optional request correlation ID echoed back in the response.
          in: header
          name: X-Request-ID
          required: false
          schema:
            example: 550e8400-e29b-41d4-a716-446655440000
            format: uuid
            type: string
        - description: id parameter
          in: path
          name: id
          required: true
          schema:
            description: UUID v4 with automatic base62 encoding for client-facing APIs
            type: string
      responses:
        '200':
          content:
            application/json:
              schema:
                properties:
                  data:
                    $ref: '#/components/schemas/MintIngestTokenResult'
                  links:
                    $ref: '#/components/schemas/ResponseLinks'
                  meta:
                    $ref: '#/components/schemas/ResponseMeta'
                required:
                  - data
                  - meta
                type: object
          description: Successful response
        '400':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
          description: Bad request
        '500':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
          description: Internal server error
      security:
        - bearerAuth: []
components:
  schemas:
    MintIngestTokenResult:
      description: >-
        Result of mintIngestToken and rotateIngestToken. The plaintext `token`
        is

        returned exactly once and is irrecoverable afterwards — clients must
        surface

        it (and the endpointUrl embedding it) to the user immediately and never

        re-fetch.
      properties:
        endpointUrl:
          description: >-
            Full ingest endpoint URL embedding the token, ready to paste into a
            vendor

            console or sender config (e.g.
            https://incoming.parable.work/v1/{token}).

            Shown once alongside the token.
          type: string
        ingestToken:
          $ref: '#/components/schemas/IngestTokenInfo'
        token:
          description: One-time plaintext token (base62). Persist nowhere.
          type: string
      required:
        - ingestToken
        - token
        - endpointUrl
      type: object
    ResponseLinks:
      properties:
        first:
          nullable: true
          type: string
        last:
          nullable: true
          type: string
        next:
          nullable: true
          type: string
        prev:
          nullable: true
          type: string
      type: object
    ResponseMeta:
      properties:
        requestId:
          description: Unique identifier for the request
          type: string
        totalCount:
          description: Total count of items for paginated responses
          nullable: true
          type: integer
      required:
        - requestId
      type: object
    Error:
      properties:
        error:
          type: string
      type: object
    IngestTokenInfo:
      description: >-
        An ingest token belonging to one of the workspace's collector taps.
        Projection

        of web-db IngestToken that never exposes the SHA-256 hash. The plaintext
        is

        returned exactly once at mint/rotation via MintIngestTokenResult.token;

        afterwards the prefix is the only user-visible identifier. Lifecycle is

        timestamp-derived: revokedAt set = rejected immediately (modulo
        collector

        cache TTL); expiresAt in the past = rejected (rotation grace elapsed).
      properties:
        createdAt:
          description: ISO8601 datetime string
          type: string
        expiresAt:
          description: >-
            Rotation grace expiry. Set on the outgoing token when a rotation
            mints its

            replacement; after expiresAt the token is rejected. Null = no
            expiry.
          type: string
        id:
          description: UUID v4 with automatic base62 encoding for client-facing APIs
          type: string
        lastUsedAt:
          description: ISO8601 datetime string
          type: string
        prefix:
          description: >-
            First characters of the plaintext token, shown in lists so the
            workspace can

            identify which token is which.
          type: string
        revokedAt:
          description: >-
            Set when the token was revoked. Revoked tokens are kept for audit
            but

            immediately rejected.
          type: string
        rotatedAt:
          description: Set when the token was rotated (a replacement row was minted).
          type: string
        tenantConnectorTapId:
          description: Flattened Relation<TenantConnectorTap> for the wire.
          type: string
        updatedAt:
          description: ISO8601 datetime string
          type: string
      required:
        - id
        - createdAt
        - updatedAt
        - tenantConnectorTapId
        - prefix
      type: object
  securitySchemes:
    bearerAuth:
      bearerFormat: JWT
      scheme: bearer
      type: http

````