> ## Documentation Index > Fetch the complete documentation index at: https://docs.flowpayroll.ai/llms.txt > Use this file to discover all available pages before exploring further. # Rename an API token, or change where it may be used from > Needs permission api-token:write. A JSON Merge Patch: send `name`, `allowedIpRanges`, or both; leave one out to keep it. The client id, the secret and the organisations it reaches are untouched. 409 `duplicate_token_name` when another token in your account already has that name. `allowedIpRanges` lists the address ranges the token may be used from: 1 to 20, IPv4 or IPv6, such as `203.0.113.0/24` or `2001:db8::/32`, with no spaces or leading zeros. Each is stored as its network address. From anywhere else every API, this one included, answers 403 `ip_not_allowed`. 400 `invalid_ip_range` names a range we cannot use. Only a person changes or lifts an existing token's ranges: an API token is refused with 403 `insufficient_permissions`, `missingPermission: api-token:write`. An API token restricted to ranges issues or rotates only tokens within them (403 `token_ranges_wider_than_yours`); one it issues without ranges gets its own. `null` lets it be used from anywhere again. Changing it needs a person who manages API tokens: a token can never change its own or another token's ranges (403 `insufficient_permissions`, `missingPermission: api-token:write`). ## OpenAPI ````yaml /api-reference/specs/administration.json patch /api-tokens/{clientId} openapi: 3.0.4 info: title: Administration API description: >- Manage your Flow Payroll account: the organisations it owns, the people who can sign in to it, the API tokens it holds, its brand, and a feed of recent administration activity. Every resource is scoped to the account your credentials belong to, so no request ever names a customer and the `X-Org-Id` header is not used. version: v1 servers: - url: https://api.sandbox.flowpayroll.ai/v1/administration security: - X-Auth-Token: [] tags: - name: Customer description: >- Your account: the customer every other resource on this API belongs to. Read it and rename it. - name: Organisations description: >- The organisations your account owns or manages: list them with headcounts and your access to each, get one in full, add one or several at a time, see everybody who can reach one, and read which of its data an outside system manages. - name: Organisation groups description: >- Named sets of your organisations, such as the clients one team looks after. Give a person or API token a group, and they reach every organisation in it, including ones added later. - name: Users description: >- The people who can sign in to your account: list, invite (one or many), resend invitations, and manage each person's direct grants and account-wide access. - name: Roles description: >- What people and API tokens can do where they have access: the built-in roles, roles of your own, and the default role. Only Administrator can be given today. - name: API tokens description: >- The client credentials your integrations authenticate with: create (the secret is shown once), rename, rotate, revoke, and manage which organisations each token reaches. - name: Branding description: >- Your white-label brand: edit a draft, publish it, upload its files, and set a company logo for each organisation. - name: Activity description: >- Recent administration actions in your account, and every change to who has access, newest first. - name: SCIM description: >- SCIM 2.0 provisioning: your identity provider adds, updates, suspends and removes your account's people, and gives them account-wide roles. paths: /api-tokens/{clientId}: patch: tags: - API tokens summary: Rename an API token, or change where it may be used from description: >- Needs permission api-token:write. A JSON Merge Patch: send `name`, `allowedIpRanges`, or both; leave one out to keep it. The client id, the secret and the organisations it reaches are untouched. 409 `duplicate_token_name` when another token in your account already has that name. `allowedIpRanges` lists the address ranges the token may be used from: 1 to 20, IPv4 or IPv6, such as `203.0.113.0/24` or `2001:db8::/32`, with no spaces or leading zeros. Each is stored as its network address. From anywhere else every API, this one included, answers 403 `ip_not_allowed`. 400 `invalid_ip_range` names a range we cannot use. Only a person changes or lifts an existing token's ranges: an API token is refused with 403 `insufficient_permissions`, `missingPermission: api-token:write`. An API token restricted to ranges issues or rotates only tokens within them (403 `token_ranges_wider_than_yours`); one it issues without ranges gets its own. `null` lets it be used from anywhere again. Changing it needs a person who manages API tokens: a token can never change its own or another token's ranges (403 `insufficient_permissions`, `missingPermission: api-token:write`). operationId: RenameApiToken parameters: - name: clientId in: path required: true schema: type: string requestBody: content: application/merge-patch+json: schema: $ref: '#/components/schemas/RenameApiTokenRequest' application/json: schema: $ref: '#/components/schemas/RenameApiTokenRequest' responses: '200': description: OK content: application/json: schema: $ref: '#/components/schemas/ApiTokenSummaryResponseResponseBody' '400': description: Bad Request content: application/json: schema: $ref: '#/components/schemas/ObjectResponseBody' '401': description: Unauthorized content: application/json: schema: $ref: '#/components/schemas/ObjectResponseBody' '403': description: Forbidden content: application/json: schema: $ref: '#/components/schemas/ObjectResponseBody' '404': description: Not Found content: application/json: schema: $ref: '#/components/schemas/ObjectResponseBody' '409': description: Conflict content: application/json: schema: $ref: '#/components/schemas/ObjectResponseBody' components: schemas: RenameApiTokenRequest: type: object properties: name: type: string description: The new display name, unique within your account. nullable: true allowedIpRanges: type: array items: type: string description: >- Address ranges the token may be used from, such as `["203.0.113.0/24", "2001:db8::/32"]`: up to 20, IPv4 or IPv6. The list replaces the old one; `null` lets it be used from anywhere again. nullable: true additionalProperties: false description: >- Changes a token's name, where it may be used from, or both. Leave a field out to keep it. ApiTokenSummaryResponseResponseBody: type: object properties: message: $ref: '#/components/schemas/MessageWithTokenResponse' content: $ref: '#/components/schemas/ApiTokenSummaryResponseContentResponse' validationIssues: type: array items: $ref: '#/components/schemas/ValidationIssue' nullable: true additionalProperties: false ObjectResponseBody: type: object properties: message: $ref: '#/components/schemas/MessageWithTokenResponse' content: $ref: '#/components/schemas/ObjectContentResponse' validationIssues: type: array items: $ref: '#/components/schemas/ValidationIssue' nullable: true additionalProperties: false MessageWithTokenResponse: type: object properties: text: type: string token: type: string tokenArguments: type: array items: $ref: '#/components/schemas/ValidationIssueArgument' nullable: true additionalProperties: false ApiTokenSummaryResponseContentResponse: type: object properties: data: $ref: '#/components/schemas/ApiTokenSummaryResponse' metadata: $ref: '#/components/schemas/ContentMetadataResponse' additionalProperties: false ValidationIssue: type: object properties: field: type: string reason: type: string reasonToken: type: string reasonTokenArguments: type: array items: $ref: '#/components/schemas/ValidationIssueArgument' nullable: true additionalProperties: false ObjectContentResponse: type: object properties: data: {} metadata: $ref: '#/components/schemas/ContentMetadataResponse' additionalProperties: false ValidationIssueArgument: type: object properties: name: type: string value: {} additionalProperties: false ApiTokenSummaryResponse: type: object properties: clientId: type: string description: >- The credential's client id: what an integration exchanges for access tokens, and how the token is addressed on this API. name: type: string description: The display name you gave it. nullable: true createdDate: type: string description: When it was issued. nullable: true callerAccess: $ref: '#/components/schemas/CallerAccessResponse' allowedIpRanges: type: array items: type: string description: >- The address ranges it may be used from; null for anywhere. On a single token and on a change, not on the list. nullable: true additionalProperties: false description: One API token as listed. No read model carries the secret. ContentMetadataResponse: type: object properties: dateFormat: type: string dateTimeFormat: type: string paginationToken: type: string nullable: true additionalProperties: false CallerAccessResponse: type: object properties: granted: type: boolean description: >- Whether you can act on this organisation. There is nothing else to say about it: everybody who reaches an organisation may do everything in it. additionalProperties: false description: What you can do with an organisation. securitySchemes: X-Auth-Token: type: apiKey description: FlowPayroll JWT (raw token, no Bearer prefix) name: X-Auth-Token in: header ```` This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.