Platform
Rotate a self-host enrollment token
Mints a new enrollment token in place, keeping the same enrollment id, metadata, and expiry. The swap is atomic: the old token stops authenticating new proxy connections the moment this call returns. An already-connected proxy keeps its existing gRPC streams until it disconnects, then must present the new token to reconnect. The new token is returned once and cannot be retrieved again.
AuthorizationBearer <token>
JWT issued by Better Auth. Verified via JWKS.
In: header
Path Parameters
org_id*string
Unique organization identifier.
Match
^[a-zA-Z0-9_.-]+$enrollment_id*string
Unique enrollment identifier.
Match
^[a-zA-Z0-9_.-]+$Response Body
application/json
application/json
application/json
application/json
application/json
application/json
curl -X POST "https://example.com/v1/organizations/org_abc123/self-host-enrollments/she_01h455vb4pex5vsknk084sn02q/rotate"{ "enrollment": { "id": "she_01h455vb4pex5vsknk084sn02q", "org_id": "org_abc123", "region_label": "customer-vpc-us-east", "description": "prod cluster", "created_by": "string", "created_at": "2019-08-24T14:15:22Z", "last_seen_at": "2019-08-24T14:15:22Z", "revoked_at": "2019-08-24T14:15:22Z", "expires_at": "2019-08-24T14:15:22Z" }, "token": "pbh_01h455vb4pex5vsknk084sn02q9zk3m7"}{ "error": { "code": "string", "message": "string" }}{ "error": { "code": "string", "message": "string" }}{ "error": { "code": "string", "message": "string" }}{ "error": { "code": "string", "message": "string" }}{ "error": { "code": "string", "message": "string" }}