# Mint a new token at the same URL

`POST /api/v1/ingest-endpoints/{id}/rotate`

MCP tool: `rotate-ingest-endpoint-token`

For a token that leaked: the URL stays and the answer carries a new token, once. The old one stops working at once, so whatever posts stops until it carries the new one. An endpoint in `none` or `signature` mode has no token of its own and answers `400`: change its `auth` with `update-ingest-endpoint`, or revoke it and publish another.

## Parameters

- `id` (path, required) — The endpoint's id.

## Responses

- `200` — The endpoint, and the new token
- `400` — The request does not match the operation's schema
- `403` — An API key cannot mint, change, rotate or revoke an ingest endpoint — a permanent credential issuing another one is an escalation. Sign in, or use a token that signing in issued.
- `404` — No such endpoint on this account, or a `suggested_project` that resolves to nothing — and the answer a project-restricted credential gets for every operation here, since the inbox has no project for a restriction to narrow.