> ## Documentation Index > Fetch the complete documentation index at: https://docs.flowpayroll.ai/llms.txt > Use this file to discover all available pages before exploring further. # Rotate an API token's secret > Issues a new secret for the same client id and invalidates the old one. Anything still using the old secret stops working immediately, so update the integration straight away. The new secret is shown once, in this response, and never again. ## OpenAPI ````yaml /api-reference/specs/administration.json post /api-tokens/{clientId}/rotate openapi: 3.0.1 info: title: Administration API description: >- Manage your Flow Payroll account: the organisations it owns, the people who can sign in to it, the API tokens it holds, its brand, and a feed of recent administration activity. Every resource is scoped to the account your credentials belong to, so no request ever names a customer and the `X-Org-Id` header is not used. version: v1 servers: - url: https://api.sandbox.flowpayroll.ai/v1/administration security: - X-Auth-Token: [] tags: - name: Customer description: >- Your account: the customer every other resource on this API belongs to. Read it and rename it. - name: Organisations description: >- The organisations your account owns: list them with headcounts and your access to each, get one in full, and add one or several at a time. - name: Users description: >- The people who can sign in to your account: list, invite (one or many), resend invitations, and manage each person's direct grants and account-wide access. - name: API tokens description: >- The client credentials your integrations authenticate with: create (the secret is shown once), rename, rotate, revoke, and manage which organisations each token reaches. - name: Activity description: Recent administration actions in your account, newest first. paths: /api-tokens/{clientId}/rotate: post: tags: - API tokens summary: Rotate an API token's secret description: >- Issues a new secret for the same client id and invalidates the old one. Anything still using the old secret stops working immediately, so update the integration straight away. The new secret is shown once, in this response, and never again. operationId: RotateApiToken parameters: - name: clientId in: path required: true schema: type: string responses: '200': description: OK content: application/json: schema: $ref: '#/components/schemas/ApiTokenIssuedResponseResponseBody' '401': description: Unauthorized content: application/json: schema: $ref: '#/components/schemas/ObjectResponseBody' '403': description: Forbidden content: application/json: schema: $ref: '#/components/schemas/ObjectResponseBody' '404': description: Not Found content: application/json: schema: $ref: '#/components/schemas/ObjectResponseBody' components: schemas: ApiTokenIssuedResponseResponseBody: type: object properties: message: $ref: '#/components/schemas/MessageWithTokenResponse' content: $ref: '#/components/schemas/ApiTokenIssuedResponseContentResponse' validationIssues: type: array items: $ref: '#/components/schemas/ValidationIssue' nullable: true additionalProperties: false ObjectResponseBody: type: object properties: message: $ref: '#/components/schemas/MessageWithTokenResponse' content: $ref: '#/components/schemas/ObjectContentResponse' validationIssues: type: array items: $ref: '#/components/schemas/ValidationIssue' nullable: true additionalProperties: false MessageWithTokenResponse: type: object properties: text: type: string token: type: string tokenArguments: type: array items: $ref: '#/components/schemas/ValidationIssueArgument' nullable: true additionalProperties: false ApiTokenIssuedResponseContentResponse: type: object properties: data: $ref: '#/components/schemas/ApiTokenIssuedResponse' metadata: $ref: '#/components/schemas/ContentMetadataResponse' additionalProperties: false ValidationIssue: type: object properties: field: type: string reason: type: string reasonToken: type: string reasonTokenArguments: type: array items: $ref: '#/components/schemas/ValidationIssueArgument' nullable: true additionalProperties: false ObjectContentResponse: type: object properties: data: nullable: true metadata: $ref: '#/components/schemas/ContentMetadataResponse' additionalProperties: false ValidationIssueArgument: type: object properties: name: type: string value: nullable: true additionalProperties: false ApiTokenIssuedResponse: type: object properties: clientId: type: string description: >- The credential's client id. Stable for the life of the token, across rotations. name: type: string description: The display name. clientSecret: type: string description: >- Shown once and stored nowhere. Null when the request replayed an earlier create, whose secret was returned to the first attempt. If it is lost, rotate the token. nullable: true organisationIds: type: array items: type: string description: The organisations the token reaches through direct grants. coversWholeCustomer: type: boolean description: >- Whether it holds account-wide access, which reaches every organisation the account owns, including ones added later. When true, `organisationIds` is not the whole picture and is usually empty. alreadyExisted: type: boolean description: >- True when this `Idempotency-Key` had already been fulfilled and nothing was created now. additionalProperties: false description: >- A newly created or rotated API token. The only response on this API that carries a secret. ContentMetadataResponse: type: object properties: dateFormat: type: string dateTimeFormat: type: string paginationToken: type: string nullable: true additionalProperties: false securitySchemes: X-Auth-Token: type: apiKey description: FlowPayroll JWT (raw token, no Bearer prefix) name: X-Auth-Token in: header ```` This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.