---
title: "rotateSelfHostEnrollment"
description: "Rotate a self-host enrollment token"
canonical: "https://pgbeam.com/docs/ts-sdk/platform/rotateSelfHostEnrollment"
last-updated: "2026-09-05T14:02:29.000Z"
---

# rotateSelfHostEnrollment

> Rotate a self-host enrollment token

URL: https://pgbeam.com/docs/ts-sdk/platform/rotateSelfHostEnrollment

Mints a new enrollment token in place, keeping the same enrollment id, metadata, and expiry. The swap is atomic: the old token stops authenticating new proxy connections the moment this call returns. An already-connected proxy keeps its existing gRPC streams until it disconnects, then must present the new token to reconnect. The new token is returned once and cannot be retrieved again.

## Usage

## Parameters

Parameter

Type

Required

Description

pathParams.org\_id

`string`

Yes

Unique organization identifier.

pathParams.enrollment\_id

`string`

Yes

Unique enrollment identifier.

## Response

`Promise<SelfHostEnrollmentSecret>`: token rotated. new token shown once.

## Example

## Errors

Status

Description

400

Invalid request parameters.

401

Missing or invalid authentication.

403

Operation not allowed by current plan limits.

404

Resource not found.

409

The enrollment is revoked and cannot be rotated.