Rotate public API token

Rotates the Public API token for a partner-managed workspace. A new token is generated, persisted according to the platform’s security rules, and the previous token is invalidated immediately. Each successful rotation returns the new raw token value and the rotated_at timestamp. Subsequent calls rotate the token again; the operation is not idempotent. Workspace ownership and billing eligibility checks apply. Partners are expected to update their integrations to use the newly issued token as soon as it is returned.

POST /workspaces/{workspace_id}/api-token

Rotate public API token

cURL

curl --request POST \
  --url https://app.timelines.ai/partner/api/v1/workspaces/{workspace_id}/api-token \
  --header 'Authorization: Bearer <token>' \
  --header 'X-TL-Partner-Id: <x-tl-partner-id>'

201

{
  "workspace_id": "<string>",
  "token": "<string>",
  "rotated_at": "2024-01-01T12:00:00Z"
}

Authorizations

Authorization · string · header · required

JWT bearer authentication. The token payload must include partner_id, nbf (not-before) and exp (expiry) claims. All Partner API requests must be authenticated with Authorization: Bearer .

Headers

X-TL-Partner-Id · string · required

The unique identifier for the partner.

Path Parameters

workspace_id · string · required

The unique identifier for the workspace.

Response

201 - application/json

Token rotated

Response payload for retrieving or rotating a workspace Public API token. Returns the workspace_id and the raw token value, and, for rotation calls, the rotated_at timestamp that indicates when the previous token became invalid.

workspace_id · string · required

Unique identifier for the workspace

token · string · required

Raw Public API token value

rotated_at · string<date-time>

Timestamp when the token was rotated and became invalid.

Example:

"2024-01-01T12:00:00Z"